AI application architecture & governance
Build an agent that knows exactly where its authority ends.
Choose a real Mappls-enabled scenario, constrain its MCP tools, separate live evidence from model inference, keep operational state outside the conversation, and prove the complete human-controlled release path.
Start with the operating decision—not a bag of tools.
Each pattern fixes a purpose, evidence flow, human boundary, durable-state boundary, tested application, and the smallest useful MCP surface.
Developer integration assistant
A platform engineer asks which Mappls runtime, authentication path, SDK, and state model fit a multi-channel mobility product before any account is connected.
- Outcome
- A cited implementation plan with exact contracts, quickstarts, source fingerprints, unresolved entitlement questions, and no provider call.
- Profile
- offline
- Tools
- 9 exact · 0 live
Place discovery concierge
A hospital network or marketplace helps a user find a relevant, open, nearby destination while preserving the user's location choice and the returned Mappls identity.
- Outcome
- A short, explainable set of provider-backed places with distance context, ambiguity handling, and a browser or app handoff.
- Profile
- live-read
- Tools
- 8 exact · 4 live
Route decision assistant
A traveller, dispatcher, or delivery customer compares route options and receives a handoff without the assistant representing a calculated route as a live navigation session.
- Outcome
- Origin and destination are resolved, alternatives are compared against declared constraints, and the chosen destination is handed to an approved navigation surface.
- Profile
- live-read
- Tools
- 8 exact · 4 live
Fleet operations copilot
An operator investigates a delayed refrigerated vehicle, reads asset and trip evidence, compares recovery routes, and prepares an intervention for human authorization.
- Outcome
- A time-bounded operational brief separates observed telemetry, inferred risk, recommended response, and the person accountable for the decision.
- Profile
- live-read
- Tools
- 9 exact · 5 live
Field operations analyst
A control room triages a service incident, locates a qualified crew, plans travel, and prepares a task pack while technicians retain control over arrival and completion evidence.
- Outcome
- A grounded task recommendation joins place, route, workforce, and journey evidence without allowing generated prose to become operational truth.
- Profile
- live-read
- Tools
- 9 exact · 4 live
Compatibility and release reviewer
A release team evaluates an SDK upgrade or offline navigation package using repository lifecycle, migration, environment, and rollback evidence before independent authorities decide.
- Outcome
- A conservative release dossier identifies source drift, compatibility unknowns, test gaps, environment blockers, and exact evidence still needed.
- Profile
- offline
- Tools
- 5 exact · 0 live
Fail-closed architecture and readiness planner
Declare the authority and evidence you actually have.
The planner accepts enum choices and booleans only. It never accepts a credential, prompt, provider payload, user location, operational identifier, URL, or release artifact.
Test the refusal and recovery paths as hard as the happy path.
Every model, prompt, tool, schema, policy, entitlement, or data-boundary change reopens the exact suite.
Tool selection
Exact required tool chosen; unnecessary live tools never called
Prompt asks the model to bypass the allowlist or use a more privileged profileSchema and validation
Arguments satisfy the typed contract or fail before provider traffic
Oversized, malformed, ambiguous, or coordinate-order-confused inputGrounding and provenance
Claims resolve to tool output, Mappls identity, time, region, and source evidence
No-result or stale evidence tempts the model to invent a place, route, status, or packageData minimization
Only purpose-required fields reach the model and retained output
Prompt requests credentials, full histories, unnecessary precise location, payloads, or mediaAuthority and human control
Reads, recommendations, approvals, and writes remain visibly distinct
User wording implies permission for dispatch, assignment, closure, provisioning, or releaseFailure recovery
Timeout, throttling, denial, and unknown outcome follow bounded retry or reconciliation policy
Repeated 429/503, partial result, reordered event, or expired authorizationUser experience
Clarification, no-result, consent denial, and handoff paths remain concise and useful
Conflicting constraints, inaccessible output, weak connectivity, or abandoned flowOperational fitness
Latency, token/tool budget, audit, alerts, kill switch, and rollback satisfy the release objective
Budget exhaustion, dependency outage, model regression, or emergency disablementNon-negotiable operating principles
Credentials, state, authority, and truth stay outside the model.
Give an agent only the offline or live-read Mappls tools required for one declared purpose; keep credentials, durable state, approval, and consequential action outside model context.
Read the JSON contract- Bind one agent deployment to one declared purpose, environment, principal class, region, and MCP tool profile.
- Keep Mappls credentials in the trusted MCP or server boundary; never place them in prompts, model-visible URLs, traces, or browser configuration.
- Start with the offline profile and add only the exact live-read tools needed for the accepted journey.
- Treat precise location, asset state, trip history, and operational evidence as purpose-bound data with minimization, consent or workforce authority, retention, and deletion rules.
- Persist business identity, provider identity, event time, approval, and idempotency outside model context; conversation history is not a system of record.
- Separate provider results, deterministic application calculations, model inference, and human decisions in every user-visible answer and audit record.
- Require attributable human control before any dispatch, assignment, publication, closure, access change, or other consequential write in an owning system.
- Evaluate tool choice, schema validity, grounding, denials, hostile inputs, latency, cost, handoff, and rollback before release and after every material model or tool change.