Case Study · Anonymized Engagement

    SaaS, rebuilt from a new starting point: agents first, humans in command.

    For a venture client, we built a multi-tenant platform where a supervisor and a fleet of ~37 declarative agents is the operating core. One domain core backs both surfaces — agents work it conversationally; humans operate it through dashboards, portals, and native mobile apps.

    TARGET MESSAGERun your operation with agents, not more staff.
    ~37
    Declarative agents
    65
    Tools in the library
    695
    REST endpoints
    93
    Domain models
    100%
    Serverless
    30d
    Durable context
    The operating core

    One supervisor. A ring of specialists. A human gate on every agent change.

    Scheduling Bookings Members Events Venues Commerce Payments Staff Communications Journal Insights Knowledge SUPERVISOR One graph deterministic routing one interrupt point Query agent (read-only) Action agent (HITL gated) ~37 declarative agents · 65 tools
    Fig. 1 — Supervisor + agent fleetGeneric operational domains · one graph
    EVERY AGENT CHANGE · SAME GATE Preview agent builds the change Interrupt state frozen · run ends Durable checkpoint survives cold containers Human decision approve · edit · reject Apply one central mutation path APPROVED BEFORE APPLY · NOTHING LANDS UNREVIEWED
    Fig. 2 — Human-in-the-loop gateDurable across cold containers
    A new perspective on SaaS

    Most software adds an assistant. We inverted the architecture.

    The agent fleet is the core; a complete conventional UX runs alongside it — nothing the agents do is out of human reach.

    01

    Agents first

    Every agent is a declarative definition — domain, operations, tool bindings. A new capability is a spec, not a new subsystem.

    Declarative · Definition-driven · The core, not a feature
    02

    Humans in command

    Dashboards, portals, and native mobile apps operate the same domain core the agents use. Every change an agent makes passes a preview → approve → apply gate.

    Dual-surface · HITL gated · Nothing opaque
    03

    Production-grade trust

    Every query is tenant-scoped by construction, and per-route RBAC bounds who can do what. Durable conversation state lets an approval land hours later and still resume cleanly.

    Multi-tenant · RBAC · Durable by default
    Spec sheet · how it's built

    The choices that make agent-first trustworthy in production.

    Six decisions. Each traces back to trust, tenancy, or scale.

    A-01
    Declarative agent framework
    Every agent is a definition — domain, operations, tool bindings — instantiated from a registry at boot; the catalog is data.
    A-02
    Single-graph orchestration
    One LangGraph StateGraph routes every request through a deterministic (operation, domain) → agent lookup — not an LLM guess per hop.
    A-03
    Serverless spine
    Container-image Lambdas fronted by Function URLs — no API Gateway or load balancer in the request path — with the agent surface streaming over SSE.
    A-04
    Durable conversation state
    LangGraph checkpoints persist in MongoDB with a 30-day TTL, so an interrupted conversation resumes in a fresh invocation with full context.
    A-05
    Hybrid retrieval
    Atlas Search resolves fuzzy entity lookups; Pinecone backs vector RAG — resolvers pick the right path per slot.
    A-06
    Isolation + RBAC
    Tenant identity is threaded into every request and tool call, per-route RBAC on top — models on Bedrock (Claude Sonnet 4.6 / Haiku 4.5), infra via Pulumi across 9×4 stacks.
    Build with us

    Building AI-native, or re-platforming a complex operation? Start agent-first.

    Declarative agent fleets, human-in-command UX, and the serverless spine to run both.

    Start a conversation →