A generative AI control layer for enterprise security

Enterprise IT blocked Siri and Google Assistant from BlackBerry Work because both leaked sensitive suggestions from the secure container. In my first week at BlackBerry, I designed and prototyped Berry: an AI assistant that lives natively inside Work's secure workspace, so employees get a conversational executive assistant without the data ever leaving the container it was never allowed to leave.

case.md

$ cat summary

first_week: designed + prototyped

lives_in: Work secure container

A ten-screen flow of the Berry assistant inside BlackBerry Work: opening with How can I help, then Billy's calendar availability, a Virgin Atlantic flight card, a map with drive time, a keyboard entry, and a confirmed meeting invite card — The full conversation, one prompt: schedule a meeting around a colleague's calendar, check a flight, and route to the venue. All inside Work's inbox.↗ open full size

Why it mattered

With Siri and Google Assistant blocked, enterprise users had no assistant at all on the phones they worked from.

60-second read

Problem

Siri and Google Assistant could surface sensitive Work data in OS-level suggestions, so IT blocked both from devices running BlackBerry Work entirely.

System decision

Build the assistant natively inside the secure container itself, so it never has to ask the OS for anything the container was built to keep in.

My contribution

Designed every screen and micro-interaction, mapped the conversation logic, and built a fully workable prototype deployable to any iPhone in one week.

Note

This was a one-week concept prototype, not a shipped feature. It is here for the product thinking, not adoption numbers.

01 · Why now

Business data was piling up faster than anyone could recall it, spread across a growing pile of apps, while conversational AI was finally cheap enough to build with.

Four things lined up at once: data overload made information hard to recall in the moment, app fatigue meant people were bouncing between tools just to get one thing done, messaging was already the interface people preferred, and NLU had gotten good and cheap enough to build an assistant with. BlackBerry had one thing none of the OS-level assistants had: standing access to business data inside a secure container, on a major mobile platform.

02 · The opportunity

A door no one else had

Siri, Google Now, and Bixby had no access to the secure container on a major mobile platform. We did.

First mover

A chance to be first to a mobile enterprise AI platform across iOS, Android, and desktop.

A natural extension

It sat on top of the BlackBerry Dynamics platform rather than beside it, so it strengthened what already shipped.

A unifying layer

One conversational surface across the software portfolio, instead of one more standalone app.

03 · What Berry does

Berry acts as an executive assistant with standing access to a user's corporate data: calendars, travel, and messaging, resolved through natural language instead of five separate apps. A single request, schedule a meeting around a colleague's availability, chains into checking a flight, calculating drive time, and sending the invite, without the user ever leaving the thread.

Berry chat showing a request to set up a meeting around Billy's calendar, followed by a BlackBerry Work availability chart with open slots highlighted — **Resolve around someone else's time.** Berry pulls a colleague's real availability into the thread rather than making the user go check it themselves.↗ open full size

A Virgin Atlantic flight card for San Francisco with arrival time, followed by a map showing a 43 minute drive from the airport to the meeting location — **Chain context automatically.** One question, when does my flight land, quietly becomes two answers: arrival time, then drive time to the actual meeting.↗ open full size

Berry confirming a meeting is set for 3:30 PM, offering Cancel and Schedule buttons, then confirming the invite was sent with an updated title — **Confirm before committing.** A calendar invite is a real-world action, so Berry surfaces it as a card to approve, not a thing it just does.↗ open full size

04 · Staying inside the container

Enterprise IT had blocked Siri and Google Assistant for a real reason: both surfaced Work data in OS-level suggestions that lived outside anyone's control. The fix wasn't to ask IT for an exception. It was to design Berry so it never needed one, native to the app, living inside the NOC, cleanly separated from the personal side of the device by construction rather than by policy.

I explored several implementation paths for where the conversation logic and service calls should live, weighing how each one held up against that same constraint: nothing crosses the container boundary that isn't supposed to.

A conversation flow diagram mapping Berry's dialog logic: intents for creating a lead, capturing name, company, and email entities, service calls to Salesforce, and branching confirmation steps — One implementation path explored: a dialog engine mapping intents, entities, and service calls, so each branch of a conversation could be reasoned about and secured on its own.↗ open full size

Trade-offs

What I chose not to doWhyWhat it protected

Let Berry act on a calendar invite without a confirmation step Scheduling a meeting on someone else's calendar is a real-world action with real consequences if the AI got the details wrong. Trust in the assistant, by keeping the human as the one who commits, not just the one who asks.

Pitch Berry as a standalone app Another app was the exact problem, app fatigue, that motivated the project in the first place. A single conversational surface people already had open, inside BlackBerry Work.

Spend the one-week sprint on a production-grade backend The sprint's job was to prove the concept was worth building, not to build the real integration layer yet. A fully workable, deployable prototype that stakeholders could hold and use in a week, not a partial backend.

Solve the trust problem first. The AI comes after.

Discuss this project