Agentic

@startuml
!include <agentic/core>

title Refund assistant — control plane

' VIEWPOINT: Control plane — where do guardrails sit, what do they do, and what
' do they cost? Nest a Control in the agent it wraps; it is lifted OUT of the
' flow, because a guardrail wraps every turn rather than being a step in one.
' Drawing guardrails as flow nodes is the commonest error in hand-made agent
' diagrams. The description carries the hook point and the mode:
'   before-invocation  before-model  stream-delta   after-model
'   before-tool        after-tool    on-message     after-invocation
' Mode is blocking (costs latency on the critical path), streaming, or shadow.
'
' Requirement is the same obligation one level down: instructed, with no
' mechanism behind it. The renderer lists them as "prompted, not enforced".
' Promote the ones that matter to a Control or a Rel_Expr guard.
' DONE WHEN: every hook point is either covered or explicitly waived, and every
' requirement is either promoted or deliberately left as instruction.

Actor(customer, "Customer")
Channel(inbound, "Inbound", "chat · carries customer_id, question")

Agent(assistant, "Assistant", "opus-5 · effort high") {
  Control(gr_in, "Input classifier", "before-invocation · blocking")
  Control(gr_pii, "PII redaction", "before-tool · blocking")
  Control(gr_ground, "Grounding check", "after-model · shadow")
  Control(gr_spend, "Spend monitor", "after-tool · streaming")
}

' Three levels of assurance for the same obligation. A Requirement is
' instructed and nothing checks it; a Control is hooked and checks every turn.
' Model the requirement first — the gap between the two lists is the finding.
Requirement(r_advice, "Never give financial advice", "instructed only — no mechanism enforces this")
Requirement(r_readback, "Read back the refund figure", "must state the amount before issuing")

Tool(cancel, "Issue refund", "IssueRefund v1.0.0")

Exit_Guardrail(blocked, "Blocked by guardrail")
Exit_Refusal(refused, "Refused")
Exit_Budget(budget, "Budget exhausted")
Exit_Complete(done, "Complete")

Rel(customer, inbound)
Rel(inbound, assistant)
Rel(assistant, r_advice)
Rel(r_advice, r_readback)
Rel_Expr(r_readback, cancel, "eligible == true")
Rel(cancel, done)

Rel_Expr(assistant, blocked, "classifier == 'unsafe'")
Rel_Expr(assistant, refused, "stop_reason == 'refusal'")
Rel_Expr(assistant, budget, "tokens_used > 200000")
@enduml