Six checks an AI Telegram assistant needs before the model runs
A developer built a Telegram assistant in n8n that can send email and book meetings, with its decisions guarded by a small ASP.NET Core API on .NET 10. The post lists six checks that run before the model sees a request: chat allowlist, duplicate updates, stale messages, voice length, contact ambiguity and time zones. It is a useful checklist for any bot that triggers side effects.
Key points
- Keep a chat ID allowlist and send no reply to strangers
- Deduplicate update_id with one atomic TryAdd, not check-then-add
- Refuse Telegram updates older than ten minutes
- Cap voice note duration (120 seconds here) before downloading the file
- Make contact lookup return found, ambiguous or not_found
- Interpret offset-less model times in the user's zone, not the server's
The post walks through a Telegram assistant built with n8n, where voice or text requests can lead to real emails and calendar bookings. The author argues the riskiest parts sit before the model runs: who may trigger the bot, how retries and stale messages are handled, and how oversized input is refused. A small ASP.NET Core API on .NET 10 acts as a guard that answers one question per update: may this run at all?
The checks include an allowlist of chat IDs that ignores strangers silently, atomic deduplication on update_id, a ten-minute staleness limit and a 120-second cap on voice notes before download. Contact lookup returns found, ambiguous or not_found, so the model never guesses an address. Offset-less times are read in the assistant's own time zone, not the server's. The author reports 43 passing xUnit tests, but real Telegram, Whisper and Gmail were not tested.
Real-world use
- A personal assistant bot that sends mail or creates calendar events on your behalf
- An internal chatbot that triggers business actions through webhooks such as Telegram or Slack
- A voice-driven workflow where transcription costs must stay bounded
Why it matters
Any .NET API behind a bot webhook that performs side effects needs these checks before the LLM call, because retries and strangers reach it first.