Where Does Deterministic Logic Live?
infrastructure path bridging deterministic services to probabilistic AI agents
Robust AI solution architecture demands a deliberate balance: deterministic logic for what must be correct, explainable, and auditable — probabilistic reasoning for what requires flexibility, judgment, and adaptation. Running the deterministic layer as an independent service, callable by any agent, produces outputs that are reliable, traceable, and reviewable — while the AI layer focuses on reasoning and orchestration. Neither alone is sufficient. Together they form a grounded, governable system.
Deterministic business logic -- calculations, rule engines, policy checks -- is stateless and portable.
But AI agents need to reach it over HTTPS to incorporate structured outputs into their reasoning.
This creates a phased path: prove the pattern locally, then migrate to owned infrastructure
once the hosting environment is ready. The deterministic service becomes the anchor that grounds the probabilistic agent.
Network Topology (Production State)
HTTPS / TLS
Auth mechanism must be confirmed with platform team
Compute
Deterministic Service
Python / FastAPI. Stateless -- no database, no sessions. Receives JSON, returns JSON. Scales horizontally.
Observability
Audit Log
Every execution logged with timestamp, inputs, outputs, caller identity. Required for compliance and audit review.
Platform initiative. The deterministic service is a concrete first tenant that demonstrates the need for internal hosting. Infrastructure and security teams are key partners. This service proves the pattern.
Open Questions -- Agent-to-Service Integration
Platform Team
Can tool calls pass structured JSON bodies?
Deterministic services need typed fields (numbers, arrays), not just query string parameters. Does the action config support POST with JSON body?
Platform Team
What auth methods for outbound calls?
API key in header? OAuth? mTLS? This determines whether the service can sit on the open internet with a key or needs network-level access control.
Platform Team
Can the agent use tool response fields?
The reasoning step after the tool call needs to reference specific fields from the service response. Does the platform pass structured responses back to the agent workflow?
Deployment Path
1
Port existing logic to Python, test against original outputs.
No hosting needed yet. Run locally, validate against the current implementation.
This is pure business logic extraction -- the hardest part is getting the rules right, not the infrastructure.
Runs on
Local machine
pytest against known test cases
Deliverable
Validated service + test suite
Proof that code matches existing logic exactly
Depends on
Access to current business logic
Domain experts provide the rule definitions
Risk
None -- fully local, reversible
No infrastructure, no security review
2
Stand up a temporary HTTPS endpoint to test with the AI platform's action gateway.
Confirm the full loop works: agent sends structured request, deterministic service returns response,
agent uses result in its reasoning. This validates the "probabilistic agent grounded by deterministic service" pattern.
Runs on
Temporary endpoint (ngrok / fly.io staging)
Throwaway -- not production
Deliverable
Working end-to-end demo
Agent calling live deterministic service
Depends on
Platform team confirms tool call capability
JSON bodies, auth, response passthrough
Risk
Low -- demo data only, no real deals
Temporary infra, torn down after demo
3
Move validated service into organization-owned infrastructure.
Same code, new home. The service is stateless Python -- migration is a deployment config change, not a rewrite.
This is where the platform pitch becomes concrete: "we have a working tool that delivers measurable value, it needs a home."
Runs on
Internal hosting environment
Organization-owned, security-reviewed
Deliverable
Production-ready deterministic service
Audit logging, monitoring, auth
Depends on
Hosting environment + security sign-off
Infrastructure and security teams
Unlocks
Proven pattern for grounding AI agents
First tenant justifies the platform for future services
The Strategic Play
Don't pitch infrastructure in the abstract. Build the deterministic service, demo it working with an AI agent, then say
"this grounded pattern delivers measurable value and needs a production home."
The conversation shifts from "we need infrastructure for AI apps" (vague)
to "we have a working tool that needs hosting" (concrete). This service becomes
the first tenant that justifies the platform -- and every future deterministic service
follows the same pattern: stateless logic, exposed over HTTPS, consumed by probabilistic agents.
Key Dependencies
Platform Team
Tool Call / Action Capability
Confirm the AI platform supports JSON POST, auth mechanisms, and structured response passthrough to agent workflow.
Target: Deep-dive technical session
Infrastructure Team
Hosting Environment
Managed compute that can host stateless Python services with HTTPS endpoints accessible from the AI platform's cloud.
Target: TBD -- pending infrastructure conversation
Security Team
Security Review
Approve external SaaS platform making authenticated API calls to internal organization service. Auth pattern and network access.
Target: After hosting + platform auth are confirmed
Phase 2: Temp demo endpoint
Phase 3: Organization infrastructure