Agentic Operations Loop
A planning agent that reasons over pipeline state, proposes write actions, and hands off to a human at every consequential step, human review is not configurable out.
- Python
- SQLite
- Internal LLM API
- Playwright
- Tool-calling orchestration
- human gate per write
- 1
- auto-commits allowed
- 0
- default on failure
- Replan
The query layer reads. The automation layer writes. The agentic operations loop connects them into a single agentic loop where the human review gate is enforced in code, not policy, and the agent replans from the point of failure instead of failing the run.
The connecting tissue
The query layer reads. The automation layer writes. The agentic operations loop connects them into one agent that can take an objective, decide which records the objective implies, propose the corresponding writes, and route everything through the same human review gate the automation layer already uses.
A manager states an objective in plain English. The agent plans the steps, queries the pipeline data to identify which records the plan touches, proposes the field changes, and waits. The manager reviews and approves. The agent commits, logs, and moves to the next step.
Constraints I had to design around
Same trust boundary as the query layer: no records to the model. The planner reasons over schema and tool descriptions, not over data.
Same write discipline as the automation layer: no silent commits, ever. Every action surfaces in a review UI with the before-state, the proposed after-state, and the rationale the agent generated.
The agent has to degrade gracefully. A failed step should not throw away the half of the plan that already worked.
What I built
A tool-calling orchestration layer where the agent's available actions are exactly the tools the query layer and automation layer already expose. The planner cannot invent new capabilities; it can only compose existing, governance-cleared ones.
A plan-state store that captures every plan, every query result, every proposed write, and every human decision, so a run is reconstructible end-to-end after the fact.
Replan, don't fail
If a step fails, the agent replans from that point rather than failing the entire run. If a write is rejected by the human, the rejection is fed back into the planner as a constraint, and the next proposal respects it.
Every decision, every plan, query result, and proposed action, is logged with full context before anything executes. Reviewers get a chronological audit trail, not a black box.
The hard constraint
The human review gate is not configurable out. Writing to the pipeline without human sign-off is not a capability the agent has, regardless of how it is prompted.
This is not a chatbot layered over a tool. It is a planning agent that reasons about pipeline state, proposes write actions, and hands off to a human at every consequential step.
"Most agentic demos prove autonomy. The product call here was the opposite, prove restraint. The interesting design surface was figuring out which decisions the agent earns and which decisions stay with the human, by construction. The next bet is expanding the tool set the agent can compose, not loosening the gate."
Builds on the same thread
- PRODUCTION
Pipeline Automation
Took a year-old, ~800-field manual revenue-ops task per run across three regions to a reviewed automation cleared by Legal, IT and enterprise security review, 87% time reduction, in production globally.
- PROTOTYPE
NL Query Layer
A natural-language query layer over pipeline data where no records ever reach the model, a 5-layer SQL guard enforces read-only access in code, not in policy.