How I built the Fusion Cloud AI-Readiness Assessment demo

Nothing but enums reaches the prompt

Every input — agent use case, transaction volume, integration method, governance controls — is validated against a fixed allowlist before anything is assembled into a prompt:

const USE_CASES = [
  "AP invoice exceptions (Fusion Payables)",
  "Procurement requisition triage (Fusion Procurement)",
  "GL journal review & anomaly detection (Fusion General Ledger)",
  "Expense report auditing (Fusion Expenses)",
] as const;
const VOLUMES = ["<1,000/month", "1,000–10,000/month",
                  "10,000–100,000/month", "100,000+/month"] as const;
const INTEGRATION_METHODS = ["No integration yet — planning phase",
  "Calling Fusion REST APIs directly",
  "Oracle Integration Cloud (OIC) as middleware",
  "Oracle AI Agent Studio (business-object + deep-link tools)"] as const;

There's no free-text field anywhere in this form. A public demo endpoint that accepts arbitrary text and feeds it to a system prompt is a prompt-injection surface; a form that only accepts membership in a known set removes that surface entirely rather than trying to sanitize around it.

The prompt reasons about the specific selection

The system prompt frames Claude as a senior AI-governance architect and explicitly instructs it to reference real Fusion Cloud ERP concepts for the use case actually selected — Payables invoice holds and matching for AP exceptions, supplier and purchase-order approval for procurement triage, chart-of-accounts and period-close controls for GL review — rather than returning generic AI-governance advice that would apply to any input. One conditional line does real work: if fewer than two governance controls are already selected as in place, the prompt requires the response to call that out as a structural blocker to autonomous agent action, not a minor gap to note in passing.

The response is validated, not trusted

Structured output from a model is still a string until proven otherwise. Before anything reaches the client:

• ✓Code fences are stripped and the outermost JSON object is extracted defensively — models sometimes wrap output in commentary even under instruction not to.
• ✓readinessScore is clamped into the 1–10 range with Math.min/Math.max, and rejected outright if it isn't a finite number.
• ✓recommendedApproach.approach is lowercased and checked against exactly three allowed values (pilot-ready / needs-guardrails / not-ready) — anything else fails the request rather than silently passing through.
• ✓keyGaps and nextSteps are truncated to 3 items regardless of how many the model returns, keeping the response shape predictable for the UI.