Making AI safe enough to act
Guardrails, validation, and human escalation for LLM agents that take real actions in production logistics operations.
Customer support and fulfillment teams needed an AI agent that could actually resolve tickets — not just draft a reply for a human to check. But the underlying systems (Zendesk, Salesforce, Deposco, Snowflake) were never built for a non-deterministic caller, and a wrong action costs real money and customer trust.
I architected the tool-augmented agent layer: intent detection, a validation pass before any tool call, and a confidence-gated escalation path to a human when the agent wasn't sure. I owned this end to end, from design through production reliability.
Request → intent classification → constrained tool selection → validation against business rules → execution against Zendesk/Salesforce/Deposco/Snowflake → confidence check → either resolve or escalate to a human queue with full context attached.
“Trading full automation for a system people would actually trust with real orders.”
The tempting path was to let the agent act whenever it produced a plausible-looking answer. I chose to gate on confidence and escalate instead of guess — trading full automation for a system people would actually trust with real orders.
Multi-intent messages that looked single-intent, third-party API timeouts and retries that could double-submit an action if not made idempotent, and silent wrong answers that look confident. Each needed its own guard, not a single catch-all.
The agent runs in production across fulfillment and 3PL support workflows. Diagnosing bottlenecks in the request path also lifted overall system throughput roughly 13×.
At 100× the volume, the fixed validation rules become a bottleneck of their own. I'd move toward a policy engine with per-customer configuration and a continuous evaluation harness, so guardrails can be tuned and tested without a redeploy.