A reference architecture that worked pretty ok

This is the honest version of a case study. A real architecture, described in shape rather than logos — no client names, no numbers I can't share. The pattern is the point.

Here's a problem shape that comes up constantly: a recurring, high-volume, customer-facing task where you badly want AI leverage — but you cannot let an unsupervised model touch a customer. Triage. Outreach. Renewal risk. The kind of work that doesn't fit one person's bandwidth and can't be trusted to run on its own.

The architecture that worked was a human-gated agentic pipeline. Agents do the volume; humans own every decision that reaches a customer.

Agents propose. Humans decide. The record turns every caught mistake into next round's correction.

What worked

Three things carried it. The verification layer — a separate, context-isolated checker that never sees the reasoning that produced a draft — caught the quiet failures that would otherwise have burned trust: a confident claim with no source behind it, a number that didn't reconcile. The human gates made it safe to run at all; "100% human approval on anything customer-facing" is boring and it is exactly why nobody got an email they shouldn't have. And the append-only record meant every error a human caught at a gate became a captured correction — the system got a little less wrong every cycle instead of repeating itself.

Three things I'd change

1. Move the cheap gate earlier. Deterministic anti-slop lint costs almost nothing and catches the tells of machine writing before a human ever spends attention on a draft. It belongs at the front of the line, not the back.
2. Don't put the human gate in the middle of the loop. Let the maker and checker converge on their own against a verifiable stop condition, and bring the human in once, at the end, to review the finished result. Loop the iteration; keep the person on the judgment.
3. Guard the data truth. An account that reads "active" in one system but has quietly churned in another will poison everything downstream. Add a freshness check against the source of record before anything gets scored or drafted — a wrong input is worse than no input.

None of this is a product. It's a pattern that held up under real use, and we're building sharper versions of it now. If you've got a task shaped like this, that's exactly the kind of problem Ethos Tech likes.