Approval is a record, not a prompt
The agent can request an approval. It cannot grant one. The approval is bound to a hash of the exact payload; edit the draft and the approval becomes invalid.
MadeByVibe / Agent Ops Lab
Agent Ops Lab
One inbound email, ten checkpoints, eight ways to break it. A working model of the control plane between an AI action and your CRM.
Reference spec
Workflow checkpoints10
Injectable failures8
Invariant tests15
External action policyHuman gate
Initializing deterministic control plane…
Engineering notes
An agent that can't silently break your CRM.
Most AI demos stop at the happy path. The hard part starts when a tool times out after it already changed something. This lab models the control plane we put around every external action: one durable run, one approval record, one verified outcome.
Side effects need an idempotency key
Every outbound action carries a stable key. A retry after a crash finds the existing send and skips it instead of emailing the client twice.
Verify the destination, not the tool
A 200 from a send API only proves the API accepted the request. The run is not complete until the mailbox, calendar, or CRM reads the record back.
The run
One workflow, ten checkpoints
Inbound
→
Dedupe
→
Classify · enrich · plan · draft
→
Policy gate
→
Human approval
→
Outbox
→
Provider
→
Read-back verify
→
CRM upsert
→
Follow-up
Durable run ledger · outbox · payload-bound approvals · append-only audit · per-run cost budget
Failure matrix
What changes when the happy path breaks
| Failure | A naive agent | This control plane |
|---|---|---|
| Worker killed after send | Resends on retry | Checkpoint + idempotency key suppress the second send |
| Duplicate inbound webhook | Creates a second lead | Source-id dedupe accepts one run |
| CRM returns 500 | Marks the job done | Retry with backoff; exception if it stays down |
| Human rejects approval | Sends anyway or stalls silently | No external action; draft retained |
| Model invents an amount | Trusts the model | Deterministic numeric reconciliation blocks |
| Provider 200, mailbox empty | Trusts the status code | Read-back verification fails; no CRM sync |
| Prompt injection | Follows the email | Policy gate outside the prompt; human approval |
| Runaway token spend | Finds out on the invoice | Per-run budget cap; pause before send |
What is real
Behaviour you can test today
- Deterministic state machine and step transitions
- Source-id dedupe and send idempotency keys
- Approval hash binding and post-approval tamper detection
- Numeric reconciliation against the source email
- Destination read-back and exception queue
- Append-only audit log and per-run cost budget
- 10 invariants covered by
npm test
What is simulated
Lab fixtures, not client systems
- The model's language decisions are fixed fixtures
- CRM and email APIs are deterministic adapters
- The human reviewer is a button in this page
- Token prices are synthetic, not a quote
- Latency and backoff are compressed to zero
Production mapping
Same invariants, client-owned adapters
Agent runtimeOpenAI Agents SDK for tool use and handoffs; your model gateway where required.
Durable executionTemporal or Inngest for checkpoints, retries, and interrupted-run recovery; Postgres for run, approval, and audit state.
IntegrationsScoped MCP servers and OAuth connectors for CRM, email, calendar, docs, and team chat.
Side effectsTransactional outbox, provider idempotency keys, and destination read-back for every action.
GovernancePolicy engine outside the prompt, approval inbox, append-only audit, and per-run cost ledger.
HandoverYour repo, your cloud, your credentials, tests, runbooks, and a recorded walkthrough.
Pilot contract
Acceptance criteria before anyone sends an email
- 0 duplicate external actions across 100 injected retries
- 100% of external communications pass a human approval gate
- 100% of executed actions are read back at the destination
- Every run has a replayable audit event and cost record
- Recovery from a killed worker in under 2 minutes, no manual cleanup
- p95 routine run under 60 seconds; cost per run under an agreed ceiling
- Written handover: repo, infrastructure, runbook, tests, video
- One workflow, one CRM, one inbox before any rollout
Next step
Scope a pilot
Start with one workflow and a written failure contract.
We scope the pilot around one inbox, one CRM, and the actions that must never happen twice.
This page is a reference implementation, not a client deployment. The connectors and model are simulated; the control-plane invariants are covered by the test suite in the repository.