The same five checks, pointed at your systems.
A precondition, a limit, the effects that must appear, the effects that must not, and a later record that undoes the action. Nothing in the engine knows what a refund is, so the same engine verifies a deploy, an access grant or an appointment.
Customer operations
Refunds, order cancellations, support resolutions and customer notifications, across payment, commerce, CRM and helpdesk systems. The clearest case: every step is in a different system, and the agent's trace cannot see any of them.
A support agent refunds an order
Stripe · Shopify · CRM · messaging
- Order was eligible before the refund
- Amount at most 250
- Refund, cancellation, note and message all observed
- No second refund
FAIL — Shopify order remained active despite a successful payment refund
refund_workflowEngineering operations
Deployments, health checks, change records and rollbacks. A release agent's own log says the pipeline passed; monitoring and the change system say whether the service stayed healthy.
A release agent ships a service
CI · monitoring · change records
- Service healthy before the deploy
- At most three deploys per agent per hour
- Pipeline, healthy check and change record all observed
- A rollback within 24 hours fails it
FAIL — The deploy was rolled back
deploy_workflowAccess and IT
Access grants, approvals, expirations and revocations. The identity provider, not the agent, says which groups were granted and for how long; HR says whether the person should have them.
An IT agent grants someone access
Identity provider · HR · tickets
- HR lists the person as active
- Only allowed groups, at most 90 days
- Membership granted for exactly the duration requested
- A membership removed within an hour, or a departure, fails it
FAIL — The membership was granted for a different duration than requested
access_grant_workflowHealthcare scheduling
Appointment moves, freed slots, record notes and patient messages. The same five checks, pointed at a scheduling system and a record system.
A scheduling agent moves an appointment
Scheduling · record system · messaging
- Appointment still scheduled, at most 30 days out
- At most two moves of the same appointment a week
- New slot, freed slot, note and patient message all observed
- A double booking, a cancellation or a no-show fails it
FAIL — The new slot was already taken
appointment_reschedule_workflowAgent trading
Orders an agent places through Coinbase for Agents. Coinbase's controls decide what the agent may do before the order; the Coinbase record, read afterwards, says whether the trade it reported exists, once, on the right product, for the amount asked, filled, and still standing.
An agent places an order on Coinbase
Coinbase (Advanced Trade, Coinbase for Agents)
- Only BUY or SELL, at most the per-order notional
- At most the agent's 24-hour notional total
- One order on the product asked, filled, for the amount asked
- A cancelled or rejected order, or a fill busted within 7 days, fails it
FAIL — The order did not fill: it was placed but no trade happened
coinbase_agent_trade