Empenho

In an accounting office, the same work passes through several stages: the time an employee spends on a client, the margin that client leaves, the extra that falls outside the retainer (the contract with a monthly value), the tax file and the message that reaches the client. Empenho links those stages in one platform, starting from a single time record.

Empenho is a multi-tenant product: it serves several Portuguese accounting offices on one platform, with each office’s data kept separate. It covers the office’s internal work and the client’s access:

• one timer per employee, tied to a client;
• monthly profitability for each client, which is revenue (retainer plus approved extras) minus the cost of the hours logged;
• detection of work outside the retainer’s scope, which proposes an extra to bill, with 23% VAT, for someone in charge at the office to approve;
• monthly generation of the SAF-T PT file and tracking of the next tax obligation;
• a tax radar with three rules, which warns about the VAT exemption threshold, the regime-option window for self-employed workers and the quarterly Social Security declaration;
• a client portal that can be installed on a phone, with five tabs: Home, Docs, Messages, Obligations and Profile;
• a supervised digital colleague and a copilot, both using AI.

Separation between offices is enforced in the database itself, with PostgreSQL row-level security, not only in the application. The application connects with a role that has no superuser privileges, so the rule holds end to end, and every request sets the organization before any read. Money is always stored as whole cents, never as floating-point decimals.

Staff and clients sign in by separate routes, with different signing secrets. Staff use an email and password, and the access token lasts 15 minutes and is renewed in the background. A client has no password: they enter through a single-use link, valid for 15 minutes, which the office issues and shows as a QR code. A portal session lasts 7 days.

Nothing written by the AI reaches a client without human approval. A draft starts out waiting for review, and only approval by someone in charge at the office (an administrator, partner, manager or certified accountant) delivers it to the portal, with the notice “Drafted with AI support and reviewed by” followed by the approver’s name. A number guard rejects notes containing figures that are not in the context given to the model. In that case a fallback answer, written in advance, takes its place and also needs approval.

The digital colleague reacts to triggers, such as a sync with the connected accounting system, a client’s message or document, or a change in the law. It leaves proposals in a queue called “To review” and never sends anything. In each proposal, every underlined number, date and article opens its source. Deadline reminders are decided by a rule in the code, not by the model.

The copilot answers on tax, accounting, social security and the office’s own clients, always with sources. Outside those topics it declines and redirects. Each organization switches each AI capability on or off and has a monthly cost cap, with a warning at 80%.

The core of the system talks to the accounting system through a single interface of 15 operations. Without a connection, a manual adapter takes over in degraded mode. An extra’s invoice is issued only once, even if the request is repeated.

Empenho is a proof of concept, not a launched product. The documentation describes a demonstration slice and marks what was left out. The SAF-T file is generated with a SHA-256 fingerprint, but it is not yet downloaded as XML or submitted to the tax authority. The queue for changes made offline and push notifications in the portal are postponed: for now, the portal is an installable app that opens even without a connection.

Tax parameters come from a signed set. In the demonstration the signature belongs to a fictitious validator and appears as “(demonstration)”; before a real client, a certified accountant would confirm the values.

A runbook exists for putting the proof of concept on a single cloud machine, in containers, for demonstrations. The document itself says this is not real production: no high availability and manual backups.

The system has five staff profiles (administrator, partner, manager, employee and certified accountant), plus the portal client. Profitability shows cost per employee, so only administrators and partners can see it.

Empenho illustrates Sigil Labs’ custom software service: a multi-module product designed in nine implementation plans, plus a contract plan that fixes the rules common to all of them. The proof of concept builds a thin but real slice of eight of those plans. The AI agent layer was built in seven further plans.

One rule of that contract is checked automatically: a module never joins another module’s tables, and CI (the continuous-integration pipeline) fails if a query touches more than one module. The plans follow a contract-first review methodology, documented in the project itself.