The command boundary
One way in. Every state change — whether a picker’s scan, a planner’s override, an ERP posting or an agent’s decision — enters through a typed, tenant-scoped, idempotent command. Commands carry identity, intent, scope and an idempotency key; replaying one is safe by construction, which is what makes offline floors and flaky provider APIs survivable.
Atomic truth. State, audit record and outbound event commit together, or not at all. If execution fails halfway, nothing is half-written and nothing is repaired by hand.
Failure is a state. Provider outages and unknown outcomes become governed UNKNOWN records with a safe recovery path — a courier booking that timed out is reconciled, never blindly retried into a double booking.
Policy layer and ledger
Allocation, approvals, carrier choice, credit, replenishment — all policies are versioned, owned and backtested against history before activation, and reversible after. A policy change is itself a command with a receipt.
The inventory ledger is append-only: corrections are new entries with reasons, never edits to history. Every recovered rupee, every adjusted count, every reversed allocation keeps its lineage — which is what makes settlement reconciliation tractable and audit sampling trivial.
The agent layer
ten internal test suites
Agents are named principals under the same policies as everyone else. They begin at suggest, earn approve-gated action by passing evaluation, and reach autonomy only inside limits you set — value ceilings, scopes, hours. If measured performance drops, autonomy steps back automatically. A kill switch exists per agent and platform-wide, and every agent action carries the agent’s identity into the audit record.
Agents propose and tune. Typed commands execute. Autonomy is the last thing you turn on, not the first.
A carrier-selection agent, in stages.
Representative data — not a logged production event.
- Signal. 1,840 shipments are flagged at risk of missing SLA this week, from carrier performance, transit-time history and current NDR rate by pin code.
- Recommendation. The agent proposes moving 1,120 of them to Carrier B, citing the policy version that triggered it.
- Impact estimate. Incremental cost, expected avoided loss and SLA improvement — shown as a calculated estimate, not a guarantee.
- Approval. A human approves or rejects, with the threshold that triggered the recommendation shown alongside it. Once approvals pass evaluation, routine cases inside a value ceiling you set can move to approve-gated action; anything above that ceiling always queues for review.
- Execution and audit. Slotwise executes only the approved action. Every step carries its identity into the audit record — who, what, when, why — and can be reversed like any other command. A kill switch, per agent or platform-wide, is always available to your administrators.
Access and evidence
Capability-level roles with segregation-of-duties checks, access-review campaigns, and just-in-time support sessions with independent approval. Evidence is captured at the moments disputes happen — scan-triggered video at pack and returns, retrievable by order — and audit workpapers are immutable.