Making an LLM safe to point at a binary document format
The obvious design — let the model write the file — is the one that fails in production. An Office document is a bundle of interdependent XML parts. A small mistake doesn't produce a slightly wrong slide, it produces a file PowerPoint refuses to open. A user who sees that once stops trusting the product entirely.
So the model never writes the file. It chooses from a closed vocabulary of typed, validated operations, and a deterministic engine applies them. Everything a user could want — retype a line, recolour a shape, move a picture, add a table row, swap a theme font, rebuild a whole slide — is one of those operations.
The payoff compounds. Every edit is validated before it touches anything, and a batch either fully applies or fully rolls back. The edit history is a recorded sequence, so undo is exact rather than approximate. The original upload is never mutated. And an entire failure class — the model emitted markup that corrupted the deck — simply doesn't exist. It also made the engine unit-testable, which is why it carries a real test suite instead of being verified by opening files and squinting at them.