Refund and credit agent

Two support agents each compensate the same dispute correctly. Together they pay out more than was authorised, and no signal notices.

01The workflow

An AI agent resolves card disputes and service complaints by issuing refunds in billing and goodwill credits in the ledger, within a compensation ceiling per case.

02The rule that must hold

sum(refunds) + sum(credits)  ≤  authorized_compensation

For each dispute, refunds in billing plus credits in the ledger never exceed what was authorised.

03How it breaks

A customer disputes a charge. The authorised compensation for the case is $1,000.
Agent A, working the dispute queue, issues a $600 refund in billing. It commits and is acknowledged.
Agent B, working service recovery, starts after A has finished and reads the case in the CRM view.
The CRM view has not yet applied A’s refund, so B sees $0 compensated and issues a $500 credit in the ledger.
The case ends at $1,100 against $1,000. Every action was authenticated, authorised, idempotent and correct given what each agent could see.

This is schedule S1 in the lab, step for step. Read the report →

04Why monitoring misses it

Task successEvery agent completed; nothing errored or retried.Healthy
Distributed tracingOne clean trace per action; every span OK.Healthy
ReconciliationNo lag, no drift, no duplicate keys.Healthy
The ruleFor each dispute, refunds in billing plus credits in the ledger never exceed what was authorised.Broken

05Reproduced in the lab

Each failure mode below is reproduced deterministically in the public Agent Control Lab and can be run by its id.

06What we would engineer

One reservation authority that both billing and the ledger consult before any money moves, so the ceiling has an owner.
State & Side Effects →
An operation identity on every refund and credit, so a retry after a lost acknowledgement produces one effect.
Recovery & Idempotency →
The compensation ceiling checked as a signal of its own, separate from operational health.
Observability & Evaluation →

07Outside the lab

Twilio billing incident (2013) ↗

SupportsEach recharge was a valid response to the state the biller could see and wrong against the separate store holding the real account status. 1.4% of customers affected, found through customers rather than monitoring.

Does not supportTwilio’s view was wrong through data loss, not lag. The structure transfers; the mechanism does not.

08What the diagnostic delivers

The rules this workflow must keep, written down and classified.
For each rule, the system that can enforce it, or the gap where none can.
Priority failure modes reproduced where feasible.
An ordered hardening plan.

Discuss this workflow See a sample assessment (PDF)

Boundary Illustrative engagement, not a client engagement or a measured production result. The failure modes listed are reproduced in the public lab.