Customs and Compliance Agents

A large industrial manufacturer files three families of regulated documents each year: an annual production-capacity report, tax-incentive permit studies and customs permit applications. The rules lived in spreadsheets, screen-recorded meetings and the heads of a few specialists, and none of it was written down. A wrong figure in these documents has regulatory consequences, so a model that produces numbers on its own was unacceptable from the start.

I reverse-engineered the processes into written specs before any code, tagging each claim as proven, theory or open, with a proof script behind the proven ones. The order of work was fixed early: the generated documents had to be correct first, and the UI and the agent came after. I worked in a small team. The lead developer owned infrastructure, identity, the model gateway and releases; I owned the department modules, the validation of the calculation engines, the front-end contract and the governance patterns. I built my part with fleets of AI coding agents working under review gates I designed: I write the requirements and acceptance criteria, read the evidence and decide.

1. 01

   Engines held to the client's history

   The model does no arithmetic. Each figure comes from a deterministic engine: renderers that reproduce the capacity report in each recipient's own format, an incentive-closure engine, a tariff-code classifier and a worksheet generator for permit applications. Before an engine was trusted, the original reference pages were vendored, their numeric output committed as golden JSON, and the port held digit-exact to it. The classifier is the one place a model judges, and only as the third tier, after a registered-link lookup and a rules engine built on the official tariff text, with an evidence pack in front of it.

2. 02

   Nothing is generated without review

   Uploads are staged, diffed against the current state and matched row by row. An ambiguous match is refused and an unmatched name fails the ingest. The prior state is backed up before any write, a person reviews the data before a document can be generated, and generation runs from a frozen snapshot. A second, independent calculation then re-adds each generated file and discards it on any difference. Anything the engines cannot price shows an explicit no-pairing state instead of a number.

3. 03

   Page-first agents with signed approvals

   Operators work on ordinary pages fed by REST data. Each department has one plain LangGraph StateGraph, a chat node and a tool node with one tool call per step, and no supervisor sits above them. Where an assistant helps, it sees the page state and drives the same controls a person would. Data-changing tools are risk-tiered: a medium-risk write parks on an approval card whose signature covers the canonical arguments, and a batch of edits becomes one approval, one audit decision and one revision bump. In an audit I found a path where front-end write tools changed the working database with no card at all, and deleted it.

4. 04

   Locked down inside the client's network

   Production runs on a server inside the client's network behind single sign-on and a login gate. Each agent has its own identity, and its effective scope is the intersection of user, agent and resource permissions, so authority can only shrink. The application has no general internet access: outbound connections follow an allowlist with a data classification per destination, and a nightly egress audit checks that vendor telemetry stays off. Each AI chat is traced per user, each tool call, admin action and data write lands in an append-only audit table, and CI scans container images for vulnerabilities. The lead developer designed the identity seam; I wrote the outbound-connection requirements.

5. 05

   Release trains with review agents

   Before a production release, seven review agents audited the candidate in parallel and filed their findings as issues. Fix agents worked on isolated worktrees, browser QA on the client's real files found new blockers in one flow, and the fixes were re-tested before the pull requests merged one CI run at a time behind a deploy runbook with a smoke test and a rollback step. Production then ran the fixed release. Migrations are forward-only, so the restore path is rehearsed.

The client's data never leaves its network, so these are recreations: the same anatomy, with invented products, people and numbers.

The system is live in production, built on four department agents and one pipeline for three document families. Correctness is shown by replay: the incentive-closure engine reproduces all 135 amounts of a closed permit, the client's own consumption matrix recomputes identically in all 1,185 cells, 166 of 166 capacity rows match the signed final reports, the application generator reproduces all 24 lines of an approved filing, and import-row classification matched the client's hand-classified file in 85 of 85 rows. In its latest full runs the agent-side suite passed 8,355 tests and the web suite 1,682; line coverage stood at 92.1 percent against an enforced floor. The same checking caught an overstated accuracy claim before it went out: an independent re-derivation did not support it, and it came out of the client draft. Limits: one of the four department agents is disabled in production, and error tracking was not yet reporting from production at the last check, so I claim tracing, token accounting and audit only.