Werk 10 — who carries it
Agentic work starts where the demo stops. A model that answers well in a chat window is a capability; a system that books the appointment, files the claim or moves the record is an operator, and it inherits every obligation an operator has — a scope, a stop, a trace and a review.
The offer
Autonomy that is engineered: agents with tools, a boundary, an audit trail and an evaluation harness, deployed behind a chokepoint you control.
What the agent may do unaided, what needs a human, and the blast radius of each tier — written down before anything is wired to a tool.
A single chokepoint for models and tools, MCP and function-calling integration, routing, quotas and cost control.
Prompt-injection defence, PII masking, output validation and the escalation path when an agent hits its boundary.
Golden sets, LLM-as-judge harnesses, trace-level lineage and the audit trail that makes an agent's action reconstructable after the fact.
Agent architecture, autonomy tiers, guardrail and eval design.
Gateway architecture, safety review, vendor and cost arbitration.
Agentic systems built, evaluated and operated.
State of the proof
Experiences that prove it
Sub-capabilities and evidence
Publishable figures
Questions
- What does this werk actually build?
- It builds the machinery around the model rather than the model itself: the tool contracts an agent is allowed to call, the gateway every call is forced through, the guardrails that run before the prompt leaves the building, the evaluation harness that decides whether the thing is fit to ship, and the audit trail that lets a regulator reconstruct a decision months later. The model is the smallest and most replaceable part of the system.
- Why does the gateway matter more than the model?
- Because governance is only enforceable at a chokepoint. Prompt-injection detection, PII masking before inference, cost routing and lineage logging are each trivial to implement once and impossible to enforce across forty scattered call sites. On the On-Kare platform every model call routes through a single governed provider, and a CI gate fails the build on any call made outside it — with no baseline and no exemption list, because the first exception normalises the second.
- How is autonomy bounded?
- By tiering it against blast radius before a line is written. A tier-zero route — one that can end a treatment, block a prescription or trigger an emergency — gets hard stops, dual control, a hold-to-confirm and no auto-dismiss. A tier-three route gets ordinary product ergonomics. The tier is declared in the file name, so a reviewer cannot miss which class of hardening applies.
- Where is the proof today?
- Two client mandates and one venture. Orange Business shipped 149 user paths including 79 dialog flows on a conversational platform, with the team scaling from 20 to 30 during delivery. Peetchr was built from scratch as an AI conversational-recruitment SaaS running on social messengers, carrying a French DeepTech label. The deeper agentic engineering — gateway, guardrails, evaluation harness, lineage — currently lives inside the On-Kare venture rather than in a client case, which is why most of this werk reads HELD rather than PROVEN.