Real-time voice agents.

What it is

A voice agent that answers your customer by voice and then does the work. It verifies who is speaking, reads real data from your database and writes back to the same systems your team already uses. Polargate builds it, hardens it and stays on it afterwards.

This page is written as a pilot, because that is what it is. What follows separates what already runs from what does not.

What our agent already does

The hotel agent inside our own product signs the guest in by voice, answers questions about the hotel, reads the real menu of each restaurant from the database, takes room service orders, creates, changes and cancels restaurant and spa bookings, triages an incident by opening a classified ticket in the same system the app uses, leaves messages for reception and hands over to reception when the property enables it.

That is 11 to 12 server tools wired to the same database functions the app calls. The agent and the app share one source of truth.

It does not make things up

The menu is read from the database. If a restaurant has no menu loaded, the agent says so instead of inventing one, and it refuses dishes that do not exist. It respects real opening days and booking windows, and when it cannot book it gives the actual schedule instead of a generic error.

Verified on 18 of 18 spoken scenarios in a July 2026 QA run against the running agent in a demo property, with audio, transcript, interface and database as evidence. An earlier preview QA in June 2026 came out at 21 of 24 perfect, with no critical failures.

Identity is checked inside the call

Room number or name plus a PIN, hashed and with lockout after failed attempts, asked once per conversation. The PIN never reaches the voice provider and never reaches the logs. The tenant is always resolved on the server, never taken from the model or from the payload.

The same agent supports two session modes: inside the app, already authenticated through a server side link, where nothing is asked of the guest; and a call mode with the full spoken verification flow.

The prompt is engineering, not a text box

The pilot agent's system prompt is around 31,000 characters, and it is compiled from the property configuration by a deterministic compiler with no language model in it. Before go live it went through an adversarial red team of twelve agents: 4 of 6 attack vectors broke the draft, and 0 of 6 got through after hardening. A separate audit went over the tool schemas and left 12 of 12 healthy.

One agent per tenant, provisioned on its own

Given a property with voice enabled, an edge function creates its agent, compiles its prompt from that property's configuration and assigns the tools its capabilities allow. That path was tested end to end in production and cleaned up afterwards. The client team edits level and capabilities from the platform itself, and the voice backend only reads that configuration through a function that fails closed and returns no guest data and no PIN.

Isolation is checked by machine, not by hand: row level security on the tables that carry a tenant id, and a guardian that discovers tenants and tables instead of listing them, running in continuous integration. As of August 2026 it watches 81 tables carrying a hotel id, and that run, against real hotel data, found no cross tenant leakage.

What it does not do yet

• No live phone number taking calls from real customers. The call leg is designed, the number is pending regulatory paperwork, and no real inbound guest call has been validated.
• No room availability and no room prices against the PMS. That layer is not open, and the availability tool covers restaurants only.
• No full duplex. The APIs available today work by turns, and no provider publishes official end to end latency figures, so we do not quote one. We have a measured synthesis latency for reading a written answer out loud, but that is text to speech, not conversation, and we do not mix the two numbers.
• Every agent we have built so far is a hotel agent. The mechanism is not hotel specific. The production evidence is.

Reading an answer out loud is not a conversation

Text to speech reads back something already written. A voice agent listens, decides and calls tools against your data. They are different products, they cost different money, and we keep their numbers apart.

The stack

The ElevenLabs conversational engine for the agent, the voice and the transcription, with the language model inside it. Our own backend on Supabase, with edge functions and database functions with controlled privilege. Secrets in a vault, never in the repository.

The platform this agent runs on is in production with real hotel guests. That is evidence for the platform, not for the voice channel, and we do not present it as voice evidence.