Owner
Workspace & AI controls
Team access, workspace policy, and proposal approval.
Independent full-stack case study · Wenduo Wang
AI prepares the plan. People approve the change.
OpsFlow is a multi-tenant field-operations workspace for intake, dispatch, evidence, and review. AI write requests stop at a proposal until an authorized user confirms them.
Isolated workspace · Fictional data · Automatic cleanup
Proposal reviewStatic interface preview
Schedule service visit
Proposal · Pending
Create the air conditioner service job, assign Sofia, and schedule the verified demo window.
- Customer
- Aiden Murphy
- Job
- Air conditioner service
- Assignee
- Sofia Nguyen · Staff
- Window
- Next business day · 14:00–15:00
No business data has changed.
Permissions, targets, and conflicts will be checked again after approval.
Current state
Pending review
No mutation applied
Next checkpoint
Owner / Manager review
Revalidate targets → commit once
A visible boundary between suggestion and execution.
AI prepares the work. Authorization remains a separate, tenant-scoped decision.
Web Agent + MCP · One Tool Registry
- 01
Proposal
AI persists a reviewable plan.
- 02
Human approval
An Owner or Manager authorizes the targets.
- 03
Revalidate & commit
Current tenant data is checked and claimed once.
Role-aware operations
Three roles. One auditable job lifecycle.
Owners set the boundary, Managers coordinate the work, and Staff carry it through with evidence.
Manager
Dispatch & review
Scheduling, assignment, and completion review.
Staff
Field work
Assigned jobs, evidence, and completion notes.
Job lifecycle
Each transition is role-checked and recorded.
- NEW
- SCHEDULED
- IN PROGRESS
- PENDING REVIEW
- COMPLETED
Claims you can inspect.
Each signal links to the code, tests, or deployment path behind it—evidence of engineering boundaries, not claims of customer scale.
Delivery status
CI-gated deployment · Successful main runs trigger production deploys
PostgreSQL-backed tests
Tenant boundaries under attack
Cross-tenant HTTP probes, database constraints, stale authorization, and proposal idempotency run against real PostgreSQL.
Multi-role browser E2E
Role handoffs in a real browser
Owner dispatch, Staff evidence and completion, Manager approval—plus proposal-first AI writes and idempotent confirmation.
Deterministic AI evals
AI behavior is regression-tested
Defined cases cover routing, target resolution, conflicts, duplicate prevention, ambiguity, and confirmation safety—not model accuracy.
EC2 · RDS · Nginx
A deployed, inspectable topology
Next.js and Express ship with Docker Compose behind Nginx and HTTPS on EC2, with PostgreSQL on Amazon RDS.
Production topology
One inspectable delivery and request path
- GitHub ActionsCI + deploy
- AWS EC2Docker Compose
- NginxHTTPS ingress
- Next.js + ExpressApplication
- Amazon RDSPostgreSQL