# AI travel assistant Diji: the portal assistant that works with the employee's permissions

Source: https://kurumsal.pro/en/ai-travel-assistant/ — Last updated: 2026-11-04

Diji is the AI assistant that runs inside the portal with the employee's own permissions; it does not apply changes without your approval. It opens as a chat panel on every signed-in page of the portal your agency gives its corporate clients, answers questions, produces reports and analysis, and presents proposed changes as approval cards.

## In short
- Diji is an AI assistant inside the corporate portal that works with the signed-in employee's own permissions; it does not apply changes without the user's approval.
- Diji does not act as a portal service user but as the signed-in employee; the action catalogue it sees is filtered by the employee's permissions, and every call is checked again against the employee's session, role and scope.
- Actions that change something require an approval card; the user can grant permission for the length of a conversation only for the change class, and deletions and irreversible actions ask for approval every time.
- Diji asks for a disclosure consent before use, masks sensitive data such as passwords, tokens and card numbers, and deletes conversations after 12 months.
- Diji answers in the portal's language, Turkish or English, and the reports it produces are versioned and can be shared inside the company.

In most corporate travel software, AI is added as a separate chat window, and what it can reach stays unclear. Diji is the AI assistant that runs inside the portal with the employee's own permissions; it does not apply changes without your approval. This page explains what Diji does, and within which limits, in the portal your agency gives its corporate clients.

## What is Diji and where does it work in the portal?

Diji is the AI assistant of the corporate portal built on DIJI.TECH infrastructure. It opens as a chat panel on every signed-in page of the portal, so an employee uses the same panel on search, cart, trips, approvals, reports or management screens. Diji answers in the portal's language, Turkish or English. Wherever it opens, it is bound to the same permission and approval rules.

Diji is not a separate chat application; it is part of the portal within DIJI.TECH's [corporate travel management software](https://www.diji.tech/en/corporate-travel-management/corporate-travel). The panel determines the surface it was opened on only from the portal's own route; it cannot be switched to another surface by a header sent with the request. That is why Diji opened in the corporate portal works by the rules of the corporate portal.

## What permissions does Diji work with?

Diji works not as a portal service user but as the signed-in employee. The action catalogue it sees is filtered by the employee's action permissions; every call it makes goes through the portal's normal chain again with the employee's session, and the session, role and data scope are resolved again on every call. No separate permission is given to Diji.

The practical result of this design is simple: what an employee cannot do in the portal, Diji cannot do either. Taking the permissions one by one:

- **Action permission:** For an employee without permission to view bookings, approve, view reports, view finance or manage, Diji cannot reach those actions.
- **Data scope:** If an employee sees only their own data, Diji sees only that; for a manager with a department or company scope, Diji works with that scope.
- **Endpoints without a session:** Portal endpoints that need no session, such as sign-in, invitation, application and site configuration, are not in Diji's list.
- **Scope instruction:** Diji works only with the data shown to the employee's own company and role; agency, tenant or profit margin data is outside its scope.

The details of the role and scope model are described on the [company admin panel](/en/company-admin-panel/) page.

## How does Diji apply a change?

Diji presents every action that changes something to the user as an approval card according to its risk class, and the action is not applied until the user approves. The user can grant a "for this conversation" permission only for an action in the change class; deletions and irreversible actions ask for a separate approval every time. Actions are divided into four risk classes: read, change, delete and irreversible.

| Action type | Approval behaviour |
|---|---|
| Read (questions, analysis, viewing a report) | Answered directly within the user's permissions |
| Change | An approval card opens; the user can allow it once or for the conversation |
| Delete | A separate approval card every time |
| Irreversible action | A separate approval card every time |

A permission given for a conversation means that the same action does not ask for a card again in that conversation, but it does not carry over to another conversation. The user can withdraw permissions from Settings, one by one or per conversation. For multi-step jobs Diji also builds a plan, offers an undo function for applied changes and can work with files the user uploads.

## What can Diji produce?

Diji shows its answers with cards next to the text: flight, hotel, package, cart, price change, report, table and chart cards. Two short commands exist for analysis and reports; their names in the product are /analiz and /rapor. The reports it produces are stored on a separate page in the portal, versioned and shareable; a shared report stays inside the company.

Two **examples** to illustrate how Diji is used:

- **Example, report:** A user with finance permission asks, "show travel spend by department for the last quarter as a table and chart." Diji prepares a table and chart card from the report data in the user's role scope; the user can save the result as a report and share it with the team.
- **Example, policy draft:** A company administrator asks Diji for a policy draft for a new nightly hotel limit. Diji prepares the draft and shows an approval card before saving; the policy does not change until the administrator approves the card. (This scenario is the example flow in the promotional video.)

The portal's own report set, meaning spend, policy compliance, savings, carbon and other reports, also works independently of Diji; the details are on the [corporate travel reporting](/en/corporate-travel-reporting/) page.

## How does Diji protect personal data?

A disclosure consent is requested from the user before Diji is used. Sensitive data in a conversation, such as passwords, tokens, API keys, card numbers, security codes and expiry dates, is masked; the AI model does not see the card number. Conversations are deleted after 12 months. These rules apply in the same way to every user of the corporate portal.

Diji's data boundaries are checked with boundary tests in the codebase. These tests verify that another company's data cannot be read, that a person in the traveller role cannot perform administrator actions, that a service token alone does not open a Diji route, that the corporate surface has no administrator or billing routes, and that a shared report stays inside the company. The portal's general security layers (two-factor authentication, passkeys, session durations, masked ID numbers) also apply when Diji is used; the details are on the [security](/en/security/) page.

## What does Diji give employees and managers?

Diji is a way of reaching information and actions that already exist in the portal by asking a question. Without moving between screens, an employee can ask which rules apply to them and what the status of their trips and requests is; a manager or finance user does the same with report data in their own scope. Answers are always limited to the data open to the person asking.

**Example** questions by role:

| Role | Example question |
|---|---|
| Traveller | "Which nightly hotel limit applies for Izmir next week?" |
| Approver | "Which of my pending approvals are out of policy, and why?" |
| Finance | "Which departments have used most of their budget this quarter?" |
| Company administrator | "What was the most frequent policy violation last month?" |

These questions are examples; Diji's answer depends on whether the portal data behind the question is open to that user. If a user without permission asks the same question, it does not open data outside their scope.

## Is Diji also in the agency panel?

Yes. Diji also works in the agency panel, and there too it is limited by the user's page permissions. The tenant administrator manages the AI settings and the billing of usage. Diji has a usage-based billing infrastructure; like the rest of the setup, pricing is set by a quote prepared for you and planned together with the agency.

For an agency this means the same assistant works in the agency's own team and in the portals of its corporate clients, and on each side only with that user's permissions. A corporate client's employee cannot reach the agency's data through Diji, and an agency user cannot reach pages they are not authorised for.

## Will AI replace corporate travel agents?

Based on how the corporate portal works, no. Diji is an assistant that works with the employee's own permissions; purchase, approval and policy rules apply in the portal exactly as before. Supplier relationships, the processing of cancellation and change requests, the review of visa documents and agent-assisted sales remain the agency's work. Diji does not take these over; it makes them easier to reach.

In the portal's design, the agency owns the process at many points. A cancellation request opened by the employee lands in the agency's operations desk, and the agency performs the actual cancellation. In a visa application the agency reviews the documents and arranges the appointment. For requests that arrive by phone, agency staff sell on behalf of the client. The agency manages the client-specific price, the service fee and the company wallet.

The contribution of AI is around this process: an employee asks what a policy says for them, why an approval is waiting or where last month's spend went, without moving between screens. A manager gets the same answers from the data in their own scope, as tables and charts. The agency's value also grows at this point: it offers its corporate client not just tickets but a travel system that is rule-based, reportable and easy to use. For an agency that gives its corporate clients a portal under its own brand, an AI assistant is a concrete way to stand out from competitors, but the policy, approval and operations design behind the assistant is built with the agency's expertise. The usefulness of AI also depends on how orderly that design is: a defined policy, the right role scope and clean employee data directly improve Diji's answers.

## What should you check when evaluating Diji?

Before offering an AI assistant to your corporate clients, a few questions need answers: whose permissions the assistant works with, how it applies changes, how it handles sensitive data, how long it keeps conversations and in which language it answers. In Diji, the answers to these questions are part of the design, not settings added later.

| Question | Answer in Diji |
|---|---|
| Whose permissions does the assistant use? | The signed-in employee's; session, role and scope are checked again on every call |
| How are changes applied? | With an approval card; deletions and irreversible actions ask every time |
| How is sensitive data protected? | Masking; the model does not see the card number |
| How long are conversations kept? | Deleted after 12 months |
| Which languages does it work in? | The portal's language, Turkish or English |
| Who are reports shared with? | They stay inside the company |

The employee's portal experience and the screens where Diji works are described on the [self-booking tool](/en/self-booking-tool/) page, and policy design is on the [travel policy management](/en/travel-policy-software/) page.

To see Diji with your own corporate client scenarios, you can request a session through the [DIJI.TECH demo page](https://www.diji.tech/en/demo).

## Frequently asked questions
### What is Diji?
Diji is the AI assistant that runs inside the portal with the employee's own permissions; it does not apply changes without your approval. It opens as a chat panel on every signed-in page of the portal your agency gives its corporate clients, and it works in the portal's language, Turkish or English.

### What data can Diji access?
Diji reaches only the data the signed-in employee can access in the portal. The action catalogue it sees is filtered by the employee's action permissions, and every call is checked again against the employee's session, role and data scope. By instruction it does not work with agency, tenant or profit margin data.

### Can Diji make a change without the user's approval?
No. Actions that change something are presented to the user as an approval card according to their risk class and are not applied until the user approves. The user can grant permission valid for the length of a conversation only for an action in the change class; deletions and irreversible actions ask for a separate approval every time.

### How does Diji protect personal data?
A disclosure consent is requested before Diji is used. Sensitive data such as passwords, tokens, API keys, card numbers, security codes and expiry dates are masked, and the model does not see the card number. Conversations are deleted after 12 months.

### What outputs can Diji produce?
Diji can show its answers with flight, hotel, package, cart, price change, report, table and chart cards. Short commands exist for analysis and reports. The reports it produces are versioned on a separate page and can be shared; a shared report stays inside the company.

### Can Diji see another company's data?
No. Because Diji works through the portal's own endpoints with the employee's session, it reaches only the data shown to that employee's company and role. That another company's data cannot be read, that a traveller role cannot perform administrator actions and that a shared report stays inside the company are checked with boundary tests.

### Can Diji also be used in the agency panel?
Yes. Diji is also in the agency panel, where it is likewise limited by the user's page permissions. The tenant administrator manages the AI settings. Diji has a usage-based billing infrastructure; the pricing is set by a quote prepared for you.

### Will AI replace corporate travel agents?
Based on how the corporate portal works, no. Diji is an assistant that works with the employee's own permissions; the agency runs supplier relationships, the processing of cancellation and change requests, the review of visa documents and agent-assisted sales. AI helps employees and managers reach information and reports in the portal faster.