05
Page 05 · Agent State Machines

Three agents.
Formal states.

Finite state machine specifications for every autonomous agent — with HITL pause nodes, rollback paths, audit annotations, and shared checkpoint architecture.

Agents 3 Formal FSMs
HITL Checkpoints 3 Pause Nodes
Monthly Volume ~4,200 Invoices Routed Mid-market mfg. · FY2024 benchmark
SLA Range 2h · 4h · 8h
Compliance EU AI Act Annex III
State Machine Overview

Every transition is
an audit record.

System Architecture · Three-Agent Coordination Topology
Cross-Agent Coordination · Pub/Sub Trigger Topology · Shared Audit Ledger
TRIGGERS Month-End Pub/Sub Daily Scheduler Invoice Ingest Feed Ad-Hoc Query IC RECON AGENT 6 SAP entities · ML anomaly detect HITL-IC-01 · 4h SLA TREASURY AGENT Bank APIs · FX feeds · 7-day model HITL-TR-01 · 2h SLA AP EXCEPTION AGENT Document AI · Exception classifier HITL-AP-01 · 8h SLA HITL PAUSE ZONE ⏸ HITL-IC-01 Group Controller ⏸ HITL-TR-01 Treasury Manager ⏸ HITL-AP-01 AP Lead SAP JOURNAL POST hitl_id required · BAPI write Immutable audit trail HEDGE EXECUTION hitl_id required · Bank API FX instruction logged ERP WRITE hitl_id for exceptions ~970 HITL / 3,230 auto AUDIT LEDGER Tamper-evident transition_id agent_id from_state → to_state hitl_id (if HITL) approver_id timestamp_utc confidence_score payload_hash EU AI Act §13 compliant
Agent Process
HITL Pause Node
System Output
Audit Ledger
HITL Escalation
Trigger / Transition
Agent 01 · Intercompany Reconciliation

Intercompany
Reconciliation Agent.

01
IC-Recon-Agent · 6 SAP Entities
Intercompany
Reconciliation Agent
Closes intercompany books at month-end across six legal entities via SAP BAPI extraction, ML-based mismatch detection, and controller-gated journal posting. Every correction write requires a HITL approval token — no autonomous ERP mutation at any confidence level.
Month-End Pub/Sub Ad-Hoc Query HITL Always Required SAP OData · BAPI ML Anomaly Detect
Finite State Machine · IC Reconciliation Agent · Full Transition Graph
IC Recon FSM · IDLE → EXTRACTING → MATCHING → HITL-IC-01 → POSTING → COMPLETE | ERROR | ROLLBACK
IDLE S₀ month-end pub/sub EXTRACTING SAP OData pull 6 entities parallel audit: extract_start trigger MATCHING ML anomaly detect confidence scored audit: match_result complete ⏸ PAUSE HITL-IC-01 Group Controller reviews flagged mismatch 4h SLA audit: hitl_dispatched flagged clean match → COMPLETE POSTING journal correction hitl_id required audit: sap_write approved rejected → IDLE (no posting) COMPLETE S_term ERROR S_stable SAP fault extraction error ROLLBACK SAP compensating journal entry audit: rollback_exec if posted rollback complete → IDLE ● state_init ● extract_start / end ● match_complete ● hitl_dispatched / resolved ● sap_bapi_write
Active State
HITL-IC-01 Pause
Terminal · OK
Rollback Path
Approved Transition
Error / Reject Path
● Audit Record at Every Transition
State Transition Table · IC Reconciliation Agent
State Type Entry Action Exit Condition Next State(s) Audit Event HITL Required
IDLE Start Await Pub/Sub trigger or ad-hoc query Trigger received EXTRACTING state_init
EXTRACTING Process Pull IC entries from all 6 SAP entities via OData; parallelised by entity All entities returned, or timeout after 30min MATCHING · ERROR extract_start · extract_complete
MATCHING Process ML anomaly detector scores each IC pair; confidence interval computed per mismatch All pairs scored; ≥1 mismatch flagged HITL-IC-01 · COMPLETE (clean) match_complete · mismatch_flagged
HITL-IC-01 ⏸ PAUSE Dispatch review task to Group Controller UI; 4h SLA timer starts; escalation to CFO at 3h50m Approve or Reject decision received with hitl_id token POSTING (approved) · IDLE (rejected) · SLA_BREACH (4h elapsed) hitl_dispatched · hitl_resolved ALWAYS
SLA_BREACH ⚠ Timeout Escalate to CFO + Finance Director; set compliance_flag=true; block POSTING until decision received Human decision received OR manual override by CFO POSTING (decision=APPROVE) · IDLE (decision=REJECT) sla_breached · escalation_fired · compliance_flagged CFO override
POSTING Write SAP BAPI journal correction write; hitl_id embedded in SAP document header. Idempotent: run_id deduplication guard — duplicate run_id returns existing confirmation, no re-write BAPI returns success or fault COMPLETE · ERROR sap_bapi_write · post_confirmed hitl_id required
COMPLETE Terminal Close period reconciliation record; notify month-end dashboard recon_complete
ERROR Stable Log structured error; page on-call engineer; if BAPI partial write → transition to ROLLBACK. No auto-retry from ERROR — requires explicit RETRYING transition with backoff. On-call engineer initiates retry or rollback ROLLBACK (if partial write) · RETRYING (transient fault, max 3) error_logged · escalation_fired
RETRYING Recovery Exponential backoff retry (×3 max); re-attempt BAPI write with same run_id (idempotent) BAPI success OR max retries exceeded COMPLETE (success) · ERROR (max retries) retry_attempt · retry_exhausted
ROLLBACK Recovery Execute SAP compensating journal entry; revert all partial writes from this run Compensating entries confirmed IDLE rollback_exec · rollback_confirmed
Formal Specification · IC Reconciliation Agent · δ Transition Function
FSM Tuple · M = (S, Σ, δ, s₀, F) — Implementable Transition Function
// S — State set
S = { IDLE, EXTRACTING, MATCHING, HITL-IC-01, SLA_BREACH, POSTING, RETRYING, COMPLETE, ERROR, ROLLBACK }
// s₀ — Initial state · F — Terminal states
s₀ = IDLE      F = { COMPLETE }      Dead-ends = { ERROR (unrecovered) }

// δ(current_state, event [guard]) → next_state
δ(IDLE,        pubsub_trigger)                                    → EXTRACTING
δ(EXTRACTING,  all_entities_returned)                             → MATCHING
δ(EXTRACTING,  timeout_30m OR odata_fault)                        → ERROR
δ(MATCHING,    [mismatches = 0])                                  → COMPLETE
δ(MATCHING,    [mismatches ≥ 1])                                  → HITL-IC-01
δ(HITL-IC-01,  decision=APPROVE, hitl_id_present)                 → POSTING
δ(HITL-IC-01,  decision=REJECT)                                   → IDLE
δ(HITL-IC-01,  [sla_elapsed ≥ 3h50m] AND no_decision)            → SLA_BREACH   // escalation fires
δ(SLA_BREACH,  decision=APPROVE, hitl_id_present)                 → POSTING
δ(SLA_BREACH,  decision=REJECT)                                   → IDLE
δ(POSTING,     bapi_success, [run_id not duplicate])              → COMPLETE     // idempotent
δ(POSTING,     bapi_fault, [no partial write])                    → ERROR
δ(POSTING,     bapi_fault, [partial write confirmed])             → ROLLBACK
δ(ERROR,       engineer_initiates_retry, [retry_count < 3])      → RETRYING
δ(RETRYING,    bapi_success)                                      → COMPLETE
δ(RETRYING,    bapi_fault, [retry_count = 3])                     → ERROR        // dead-letter
δ(ROLLBACK,    compensating_entry_confirmed)                      → IDLE
HITL-IC-01 · Intercompany Correction Approval
Group Controller Review — Every Correction Posting
No journal entry correction may be written to SAP without a human approval token from a credentialed Group Controller. The ML model's confidence score is displayed in the review UI but does not bypass the gate at any threshold — there is no autonomous posting path. The hitl_id is embedded as a custom field in the SAP document header, creating a permanent, auditor-readable link between the AI recommendation and the human decision.
Checkpoint ID HITL-IC-01
SLA 4 hours
Approver Group Controller
Escalation CFO at 3h 50m
Trigger Any flagged mismatch
Token Required hitl_id in SAP header
Agent 02 · Cash & Treasury

Cash & Treasury
Agent.

02
Treasury-Agent · Bank APIs · FX Feeds
Cash & Treasury
Agent
Aggregates real-time cash positions from bank APIs and FX feeds, generates a 7-day liquidity forecast with confidence intervals, and proposes FX hedge instructions. Daily cash positioning reports are autonomous — hedge execution always requires Treasury Manager sign-off.
Daily Scheduler Bank APIs · SWIFT gpi FX Feeds Hedge > €500K → HITL Confidence < 0.75 → HITL
Finite State Machine · Cash & Treasury Agent · Full Transition Graph
Treasury FSM · IDLE → FETCHING → FORECASTING → ANOMALY_CHECK → HITL-TR-01 → EXECUTING → COMPLETE | ERROR
IDLE S₀ daily FETCHING bank APIs + FX feeds SWIFT gpi · open bank audit: fetch_start FORECASTING 7-day cash model confidence interval audit: forecast_run ANOMALY CHECK audit: check_result conf ≥ 0.75 AND hedge ≤ €500K → autonomous cash report (no HITL) DAILY REPORT No HITL · Auto-publish ⏸ PAUSE HITL-TR-01 Treasury Manager forecast + FX hedge review 2h SLA audit: hitl_dispatched triggered conf < 0.75 OR hedge > €500K EXECUTING hedge to bank API hitl_id required audit: hedge_instruction approved rejected → IDLE (no execution) COMPLETE S_term ERROR S_stable bank fault ● state_init ● fetch_start/end ● forecast_run ● check_result ● hedge_instruction
Decision Node
HITL-TR-01 Pause
Autonomous Report (no HITL)
HITL Escalation
Auto-Approve Path
State Transition Table · Cash & Treasury Agent
State Type Entry Action Exit Condition Next State(s) Audit Event HITL Required
IDLE Start Await daily scheduler or FX alert Scheduled trigger fires FETCHING state_init
FETCHING Process Pull positions from bank APIs (SWIFT gpi, open banking); pull live FX rates All feeds returned or timeout 15min FORECASTING · ERROR fetch_start · fetch_complete
FORECASTING Process Run 7-day cash model; compute confidence interval; generate FX hedge recommendation Model returns forecast + confidence ANOMALY_CHECK forecast_run · forecast_complete
ANOMALY_CHECK Decision Evaluate: confidence < 0.75 OR proposed hedge > €500K? Decision threshold evaluated HITL-TR-01 (triggered) · COMPLETE (auto-report) anomaly_check_result Conditional
HITL-TR-01 ⏸ PAUSE Dispatch forecast + hedge recommendation to Treasury Manager; 2h SLA; escalation to CFO at 1h45m. Compound trigger: if both conf < 0.75 AND notional > €500K fire simultaneously, a single consolidated HITL task is created with both conditions surfaced in the review UI — one hitl_id issued. Approve or Reject with hitl_id EXECUTING (approved) · IDLE (rejected) · SLA_BREACH (2h elapsed) hitl_dispatched · hitl_resolved ALWAYS (when triggered)
SLA_BREACH ⚠ Timeout Escalate to CFO + Head of Treasury; set compliance_flag=true; hedge execution blocked until decision received Human decision received or CFO override EXECUTING (decision=APPROVE) · IDLE (decision=REJECT) sla_breached · escalation_fired · compliance_flagged CFO override
EXECUTING Write Send hedge instruction to bank API; hitl_id attached to instruction record. Idempotent: instruction_id deduplication — duplicate instruction_id returns existing confirmation without re-executing Bank API confirms or faults COMPLETE · ERROR hedge_instruction · exec_confirmed hitl_id required
COMPLETE Terminal Publish daily treasury dashboard; archive forecast record treasury_complete
ERROR Stable Log structured error; alert Treasury Operations. No auto-retry — requires explicit operator-initiated RETRYING transition with exponential backoff (max 3 attempts). Operator initiates retry RETRYING (transient, max 3) · IDLE (unrecoverable, manual reset) error_logged · escalation_fired
RETRYING Recovery Exponential backoff retry (×3 max); re-attempt bank API call with same instruction_id (idempotent) API success OR max retries exceeded COMPLETE (success) · ERROR (max retries) retry_attempt · retry_exhausted
HITL-TR-01 · Hedge Execution Approval
Treasury Manager Review — Forecast + FX Hedge Instruction
Two independent conditions each route the agent to HITL-TR-01: forecast confidence below 0.75, or a proposed hedge exceeding €500K notional. When both conditions are true simultaneously, a single consolidated HITL task is issued — one hitl_id, one review UI, both trigger conditions displayed. Daily cash positioning reports (confidence ≥ 0.75 AND notional ≤ €500K) publish autonomously with no approval required. The distinction between report (autonomous) and execution (HITL-gated) is architectural, not policy: the agent cannot self-escalate a report into an execution.
Checkpoint ID HITL-TR-01
SLA 2 hours
Approver Treasury Manager
Escalation CFO at 1h 45m
Trigger 1 Confidence < 0.75
Trigger 2 Hedge > €500K notional
Compound Case Both triggers → 1 consolidated task · 1 hitl_id
Formal Specification · Cash & Treasury Agent · δ Transition Function
FSM Tuple · M = (S, Σ, δ, s₀, F) — Implementable Transition Function
S = { IDLE, FETCHING, FORECASTING, ANOMALY_CHECK, HITL-TR-01, SLA_BREACH, EXECUTING, RETRYING, COMPLETE, ERROR }
s₀ = IDLE      F = { COMPLETE }

// δ(current_state, event [guard]) → next_state
δ(IDLE,          daily_scheduler_trigger)                                      → FETCHING
δ(FETCHING,      all_feeds_returned)                                           → FORECASTING
δ(FETCHING,      timeout_15m OR api_fault)                                     → ERROR
δ(FORECASTING,   model_complete)                                               → ANOMALY_CHECK
δ(ANOMALY_CHECK, [conf ≥ 0.75 AND notional ≤ €500K])                          → COMPLETE  // auto-report
δ(ANOMALY_CHECK, [conf < 0.75 OR notional > €500K])                           → HITL-TR-01
δ(HITL-TR-01,    decision=APPROVE, hitl_id_present)                           → EXECUTING
δ(HITL-TR-01,    decision=REJECT)                                             → IDLE
δ(HITL-TR-01,    [sla_elapsed ≥ 1h45m] AND no_decision)                      → SLA_BREACH
δ(SLA_BREACH,    decision=APPROVE, hitl_id_present)                           → EXECUTING
δ(SLA_BREACH,    decision=REJECT)                                             → IDLE
δ(EXECUTING,     bank_api_success, [instruction_id not duplicate])            → COMPLETE   // idempotent
δ(EXECUTING,     bank_api_fault)                                              → ERROR
δ(ERROR,         operator_retry, [retry_count < 3])                          → RETRYING
δ(RETRYING,      bank_api_success)                                            → COMPLETE
δ(RETRYING,      bank_api_fault, [retry_count = 3])                          → ERROR      // dead-letter
Daily
Autonomous cash
position report
7-Day
Liquidity forecast
horizon
€500K
Hedge notional
HITL threshold
0.75
Confidence threshold
for autonomous routing
2h
HITL-TR-01
SLA window
Agent 03 · AP Exception

AP Exception
Agent.

03
AP-Exception-Agent · Document AI · Exception Classifier
AP Exception
Agent
Parses invoice documents via Document AI, classifies each against five exception categories, auto-routes clean approvals, and pauses on exceptions for AP Lead review. 77% of monthly volume is approved autonomously; 23% routes to HITL-AP-01.
Invoice Ingest Feed Document AI Parse PO_MISMATCH PRICE_VARIANCE MISSING_CC DUPLICATE Exceptions → HITL-AP-01
Finite State Machine · AP Exception Agent · Full Transition Graph
AP Exception FSM · IDLE → INGESTING → CLASSIFYING → [APPROVED auto | HITL-AP-01] → POSTING → COMPLETE | ERROR
IDLE S₀ INGESTING Document AI parse OCR + field extract audit: ingest_start ingest CLASSIFYING Exception classifier PO_MISMATCH · PRICE_VAR MISSING_CC · DUPLICATE · APPROVED audit: classification ↓ EXCEPTION ~970/month → HITL APPROVED? conf≥0.92 ↑ APPROVED ~3,230/month auto AUTO POSTING ERP write · no hitl_id ⏸ PAUSE HITL-AP-01 AP Lead reviews exception invoice 8h SLA audit: hitl_dispatched POSTING ERP write hitl_id for exceptions audit: erp_write approved rejected → IDLE COMPLETE S_term ERROR S_stable ERP fault parse error ● state_init ● ingest_start/end ● classification ● erp_write
Ingestion / Parse
HITL-AP-01 Pause
Auto-Approved Posting
Exception Escalation
Auto-Approve Path
State Transition Table · AP Exception Agent
State Type Entry Action Exit Condition Next State(s) Audit Event HITL Required
IDLE Start Await invoice ingest feed event Invoice batch arrives INGESTING state_init
INGESTING Process Document AI OCR parse; extract PO number, line items, vendor, amount, cost centre Parse complete or Document AI fault CLASSIFYING · ERROR ingest_start · ingest_complete
CLASSIFYING Process Exception classifier assigns label: PO_MISMATCH · PRICE_VARIANCE · MISSING_CC · DUPLICATE · APPROVED. APPROVED label requires classifier confidence ≥ 0.92 AND no rule-based exception flags — below threshold routes to HITL regardless of label. Label assigned with confidence score HITL-AP-01 (exceptions or conf < 0.92) · POSTING-AUTO (APPROVED, conf ≥ 0.92) classification · routing_decision
HITL-AP-01 ⏸ PAUSE Route to AP Lead review queue with exception label, original invoice, PO diff, and confidence score; 8h SLA timer starts; escalation to Finance Controller at 7h Approve or Reject with hitl_id POSTING (approved) · IDLE (rejected) · SLA_BREACH (8h elapsed) hitl_dispatched · hitl_resolved ALWAYS (exceptions)
SLA_BREACH ⚠ Timeout Escalate to Finance Controller + AP Manager; set compliance_flag=true; invoice remains parked; supplier notified of hold extension Human decision received POSTING (decision=APPROVE) · IDLE (decision=REJECT) sla_breached · escalation_fired · supplier_notified Controller override
POSTING Write ERP write; hitl_id attached for exception invoices; null hitl_id for APPROVED-auto path. Idempotent: invoice_id deduplication guard — duplicate invoice_id returns existing ERP confirmation, no re-write ERP confirms or faults COMPLETE · ERROR erp_write · post_confirmed hitl_id for exceptions
COMPLETE Terminal Mark invoice processed; update AP dashboard; trigger payment run eligibility invoice_complete
ERROR Stable Log structured error; flag invoice for manual triage; alert AP Operations. No auto-retry — explicit operator-initiated RETRYING transition required. Operator initiates retry or manual triage RETRYING (transient, max 3) · IDLE (unrecoverable) error_logged · invoice_flagged
RETRYING Recovery Exponential backoff retry (×3 max); re-attempt ERP write with same invoice_id (idempotent) ERP success OR max retries exceeded COMPLETE (success) · ERROR (max retries) retry_attempt · retry_exhausted
HITL-AP-01 · AP Exception Invoice Review
AP Lead Review — PO Mismatch, Price Variance, Missing CC, Duplicate
Any invoice classified as PO_MISMATCH, PRICE_VARIANCE, MISSING_CC, or DUPLICATE is routed to HITL-AP-01. Additionally, any APPROVED-labelled invoice where the classifier confidence is below 0.92 is also routed to HITL — the confidence gate is a hard floor, not advisory. The AP Lead sees the exception label, the confidence score, the original invoice image, and the PO differential highlighted. Invoices classified APPROVED with confidence ≥ 0.92 bypass HITL entirely — the hitl_id field is null in the ERP record, which is itself a searchable audit condition.
Checkpoint ID HITL-AP-01
SLA 8 hours
Approver AP Lead
Escalation Finance Controller at 7h
Exception Labels PO_MISMATCH · PRICE_VARIANCE · MISSING_CC · DUPLICATE
Auto-Bypass Threshold APPROVED label AND confidence ≥ 0.92
Formal Specification · AP Exception Agent · δ Transition Function
FSM Tuple · M = (S, Σ, δ, s₀, F) — Implementable Transition Function
S = { IDLE, INGESTING, CLASSIFYING, HITL-AP-01, SLA_BREACH, POSTING, RETRYING, COMPLETE, ERROR }
s₀ = IDLE      F = { COMPLETE }

// δ(current_state, event [guard]) → next_state
δ(IDLE,        invoice_batch_arrives)                                          → INGESTING
δ(INGESTING,   parse_complete)                                                 → CLASSIFYING
δ(INGESTING,   document_ai_fault)                                              → ERROR
δ(CLASSIFYING, [label ∈ {PO_MISMATCH,PRICE_VARIANCE,MISSING_CC,DUPLICATE}])   → HITL-AP-01
δ(CLASSIFYING, [label = APPROVED AND conf < 0.92])                            → HITL-AP-01  // conf gate
δ(CLASSIFYING, [label = APPROVED AND conf ≥ 0.92])                            → POSTING     // auto-path
δ(HITL-AP-01,  decision=APPROVE, hitl_id_present)                            → POSTING
δ(HITL-AP-01,  decision=REJECT)                                              → IDLE         // invoice parked
δ(HITL-AP-01,  [sla_elapsed ≥ 7h] AND no_decision)                          → SLA_BREACH
δ(SLA_BREACH,  decision=APPROVE, hitl_id_present)                            → POSTING
δ(SLA_BREACH,  decision=REJECT)                                              → IDLE
δ(POSTING,     erp_success, [invoice_id not duplicate])                      → COMPLETE     // idempotent
δ(POSTING,     erp_fault)                                                    → ERROR
δ(ERROR,       operator_retry, [retry_count < 3])                           → RETRYING
δ(RETRYING,    erp_success)                                                  → COMPLETE
δ(RETRYING,    erp_fault, [retry_count = 3])                                 → ERROR        // dead-letter
~4,200
Total invoice volume
per month
~3,230
Auto-approved
autonomous posting
~970
Exception invoices
routed to HITL-AP-01
77%
Autonomous approval
rate (no HITL)
8h
HITL-AP-01
SLA window
Shared HITL Specification

Three checkpoints.
One audit architecture.

HITL Checkpoint Architecture · Cross-Agent · Shared Approval Infrastructure
HITL Infrastructure Topology · Dispatch · Review UI · Escalation · Audit Token Flow
IC RECON AGENT flagged mismatch TREASURY AGENT conf < 0.75 / >€500K AP EXCEPTION AGENT exception invoice HITL DISPATCHER Route by agent + type SLA timer start audit: hitl_dispatched GROUP CONTROLLER Review UI · HITL-IC-01 4h SLA TREASURY MANAGER Review UI · HITL-TR-01 2h SLA AP LEAD Review UI · HITL-AP-01 8h SLA CFO / ESCALATION HITL TOKEN hitl_id generated approver_id attached audit: decision_token IMMUTABLE AUDIT LEDGER hitl_id · agent_id · checkpoint_id approver_id · approver_role decision (APPROVE | REJECT) sla_start · sla_end · overdue_flag confidence_score · payload_hash escalation_path · escalated_to EU AI Act §13 · GDPR Art.5/25 compliant token write
HITL Dispatcher
Approver Review UI
HITL Token · hitl_id
Immutable Audit Ledger
Escalation Path
Shared HITL Specification Table · All Three Agents
Checkpoint ID Agent Trigger Condition SLA SLA Breach → State Approver Escalation Escalation At hitl_id Required Rejection Route
HITL-IC-01 IC Recon Agent Any flagged IC mismatch detected by ML anomaly detector. No confidence threshold — HITL is unconditional for all corrections. 4 Hours SLA_BREACH · compliance_flag=true · CFO notified · POSTING blocked Group Controller CFO + Finance Director 3h 50m SAP BAPI header (required for all ERP writes in this agent) IDLE · no journal posted · reason logged
HITL-TR-01 Treasury Agent Forecast confidence < 0.75 OR proposed FX hedge notional > €500,000. Either condition independently triggers. Both conditions simultaneously → single consolidated HITL task, one hitl_id. Below threshold + below notional → autonomous daily report only. 2 Hours SLA_BREACH · compliance_flag=true · hedge blocked · CFO + Head of Treasury notified Treasury Manager CFO + Head of Treasury 1h 45m Bank API hedge instruction record (required for all execution writes) IDLE · no hedge executed · forecast published as advisory only
HITL-AP-01 AP Exception Agent Exception classifier assigns label PO_MISMATCH, PRICE_VARIANCE, MISSING_CC, or DUPLICATE — OR — any APPROVED-labelled invoice where confidence < 0.92. APPROVED label with confidence ≥ 0.92 bypasses HITL and posts autonomously with null hitl_id. 8 Hours SLA_BREACH · compliance_flag=true · invoice parked · Finance Controller + AP Manager notified AP Lead Finance Controller + AP Manager 7h 00m ERP write record (required for exception class invoices; null for APPROVED class ≥ 0.92) IDLE · invoice parked · supplier notified of hold
AE Platform Hooks
HITL Orchestrator Audit Ledger · Tamper-Evident EU AI Act §13 GDPR Art. 5/25 SLA Escalation Engine Identity & Access · Role Gate Strategy Dashboard · HITL Metrics
Immutable Audit Ledger — Implementation: All state transition and HITL decision records are written to a BigQuery append-only partitioned table with no UPDATE or DELETE permissions on the agent service account (IAM deny policy). Each record includes a SHA-256 payload hash of the decision payload for tamper-detection. Long-term archival uses GCS Bucket Lock (WORM mode) with a 7-year retention policy per SOX requirements. The ledger schema is append-only by design — corrections are new records, never overwrites. This architecture satisfies EU AI Act §13 transparency obligations and GDPR Art. 5(1)(f) integrity requirements without reliance on a blockchain or external notarisation service.