The transcription is one API call. The product is everything else.
The transcriber demoed after one evening. The product is two quarters of work around one API call: per-owner encryption, client-held keys, voiceprint identity, five connectors, and authz that answers snoops with a 404. The evening-demo gap is the product, and agents are why one person can cross it.
The demo took one evening. The product took two quarters.
The working transcriber was one API call. Point an audio file at a speech API, get text back with speaker turns. A couple hundred lines. It demoed the same night.
Then the real questions started. Not one of them was about transcription.
That distance needs a name: the evening-demo gap. Everything I'd trust near a real meeting lives inside it.
It is also a clean look at what agents actually changed. When people say "AI built it," they mean the transcription. The one API call. It was the smallest part of the build by a mile.
The product is everything else. It answers four questions the demo never has to face.
Whose is it?
Cannot look beats promise not to look.
Meeting transcripts are the most sensitive text an org produces. Comp talk. Reorg plans. The sentence someone said trusting the room was closed. So the first real question is a threat model.
The crown jewels are encrypted at rest, per owner: transcript, summaries, titles, speaker names. The database instance sits under customer-managed keys on top of that.
Two layers, because there are two different attackers.
Instance-level keys answer the stolen-disk class of problem. The per-owner layer answers a nastier one: my own bugs. A query that wanders across an owner boundary comes back ciphertext, not someone else's meeting.
Then comes the harder version, the one worth building: keys held by the client. Generated on the device. Never escrowed on the server. The service has no standing ability to read your meetings, even if it wanted to.
Not "we promise not to look." Cannot look.
Then crypto-shred. Destroy the key and the content is mathematically gone. That's what "delete my data" should mean. What it usually means is a flag in a row somewhere while the bytes live on in backups. Crypto-shred turns deletion from a promise into arithmetic.
No key, no plaintext.
None of that is AI work. It's the work that puts you in the news when you get it wrong, and it ate most of the codebase. Open the table and the four payload columns read as noise: transcript, summary, title, speaker names. All ciphertext.
Who said what?
The feature is "show me names instead of numbers." The work underneath is consent and access control around a biometric identifier.
Diarization hands you "Speaker 0" and "Speaker 1." Users want names. Between those two sentences sits a separate machine: voice embeddings, a vector search matching a voice against known prints, and an enrollment flow to register those prints in the first place.
A voiceprint is biometric data. You can rotate a password. You cannot rotate your voice. A print made from one meeting identifies that person in every meeting after it.
So enrollment is a privileged action: one role, audited, revocable.
The feature stops being a feature as soon as the system remembers who someone sounds like.
Where do recordings even come from?
People hand-upload an audio file twice, maybe. Then never again.
The recordings have to arrive on their own, which means connectors: Drive, Google Meet, Zoom, a Slack bot, live mic capture in the browser.
Each one is a different auth model. Drive wants a per-user OAuth grant. The Slack bot holds a workspace token. Live capture is a browser tab you have to keep alive with an open microphone.
Discovery differs just as much: watching a folder is not receiving a webhook is not sitting inside the call. Five sources, zero shared shortcuts.
Every one of them ends at the same puzzle. A file shows up. Who does it belong to?
Get it wrong once and you've handed someone's meeting to a stranger. In a product whose entire pitch is "your meetings stay yours," one wrong attribution kills the pitch.
Take Drive, the boring connector. The OAuth grant belongs to whoever connected the integration. The recording belongs to whoever hit record. The meeting belongs to whoever ran it, and that can be a third person entirely.
Three candidates, one owner column, and the only identity the token actually proves is the first.
Who can see it?
Row-level authz on every read and every mutate.
There is no code path around it: the query layer takes an owner id or it doesn't run.
The detail that matters most is one digit. A non-owner asking for a recording gets a 404, not a 403.
A 403 says "this exists and you can't have it." That sentence already leaks. On sensitive data, "this exists" is itself a disclosure. Someone probing IDs learns which ones are real, and that's reconnaissance you handed out for free.
A 404 says nothing. The snoop learns nothing, not even that there's something worth wanting.
One digit. The diff is one line. The reasoning behind it is nowhere in the code. It lives in the threat model, and someone has to have written one.
The smallest part
There is an LLM layer: summaries, cleanup, speaker relabeling. It runs as a pluggable pipeline where I can swap Claude for Gemini without a redeploy. A few prompts and a provider interface.
That pipeline later grew into the most interesting machinery in the system: three models drafting in parallel with a judge merging them. What happened to it after seven weeks of audited production is its own post.
Here it gets two paragraphs on purpose.
The piece people picture when they hear "AI meeting tool" was genuinely the least of the work. The product is everything wrapped around it.
What agents changed
Agents built the parts I specified, fast.
Before agents, a project like this needed a team and a quarter, and most of what that team would have done is type. Remove the typing and the same build fits one person and two quarters.
The calendar doubled. The headcount collapsed to one. I'll take that trade every time.
But one person and two quarters flatters the agents if I leave out what they did not decide.
No agent decided what gets encrypted, who holds the keys, which role touches biometrics, or what a 404 is protecting. Those decisions are the product.
"AI built my product" is the wrong story. Agents erased the typing. The judgment calls stayed.
The gap is the product
The easy part got commoditized. That's what "easy" means now: everyone can build the demo, so the demo is worth nothing. The value moved into the questions the demo never has to answer.
Those questions reward judgment, not typing speed. They are the ones that bite a year later if you get them wrong.
Whoever crosses the evening-demo gap owns a product. Everyone else owns a demo.
How a director who stopped writing code in 2015 gets to ship again at all is a different story. I am that director.
The transcription call is still a couple hundred lines. Everything around it took two quarters. That ratio is the post.