Capture the real org, write the PRD, let AESOP run the build with a platform choice — then prove it on synthetic data. The org is real; only the data is fake — and that’s enough to stand up a working demo, fast.
Capture the org — the real before-state (4 hrs/wk rebuilding health by hand, risk surfacing late), the real stack, the real constraints. End in open questions, not assumptions.
The spec set: a governance contract, the architecture and prompt-vs-code line, and the build-ready PRD. Rules locked before code.
The PRD feeds AESOP, which runs the build and makes a platform choice: FastAPI on Fly (backend), Next.js on Vercel (frontend), Supabase for data + auth, and a provider-flexible LLM (DeepSeek / Anthropic).
A 12-account book exercises every rule and both draft framings. Synthetic data removes the blockers — no real customer data leaves the governed environment, no approval to wait on — so it’s fast enough to stand up a demo that’s still grounded in a real, captured org.
The decision that governs every stage: what lives in deterministic code and what the model is allowed to do.
| Decision | Where | Why |
|---|---|---|
| Risk scoring & thresholds | Code | Reproducible, auditable, cheap |
| Escalation routing | Code | Deterministic — never skipped |
| Grounding check | Code + LLM judge | Deterministic trace + semantic check |
| Health narrative | Prompt | Language synthesis is the model’s job |
| Renewal draft | Prompt | Tone + framing, human-reviewed |
The risk math is code, never the LLM. A flag means the same thing every run, and every claim traces to a signal or a quoted sentence.
Nothing asserted without a receipt. Missing usage is reported as a gap, never fabricated into a trend.
Everything customer-facing stays draft. The CSM confirms every flag and edits every draft — the agent never sends.
Self-scored weekly, and not a rigged 100% — escalation accuracy is pinned at 85.7%, because one judgment-boundary case is the point of the eval.