ADR-001: Approved policy versions, human gates, tool allowlist and fixed disclosure for the support assistant

1. Where answers come from. The plan has the model answer "from our policies" by loading the help-center page and the wiki page into its instructions, and "says nothing about which source wins, about citing the source, or about what happens when no policy covers a question" (evidence/agent-proposal.md). The three sources in use give different return windows: help-center page 30 days, wiki page 45 days ("holiday extension", added November 2024, never removed), handbook PDF 14 days opened and 30 days unopened. "Nothing in any of them says which one governs. None has an effective date." (evidence/policy-sources.md). Agents already give customers all three: "Last month I saw chats where three agents told customers 30, 45 and 14 days for the same kind of return." (interviews/2026-10-19-dvorak-support-team-lead.md). Fanny Mendelssohn has drafted a policy record format (policy_id, version, owner, effective_date, status, approved_by), "but nothing has been entered and nobody has agreed who owns the returns policy" (interviews/2026-10-16-mendelssohn-governance-lead.md). Finding F-005 (high).

2. Refund limit and approval. The plan's issue_refund would "refund whatever the customer is entitled to under policy", and "The plan states no amount limit on issue_refund and no approval step for any action" (evidence/agent-proposal.md). Today, "Refunds up to $100 are at the agent's discretion. Larger refunds go to a team lead (Dvořák or the other shift's lead)", and refunds go through the payment provider by order ID (evidence/process-notes.md). Antonín Dvořák: "I approve refunds over $100. Nobody has asked me how that works with the bot." (interviews/2026-10-19-dvorak-support-team-lead.md). Clara Schumann: "The point is that it just sorts the refund out. Capping it at $100 defeats the purpose." (interviews/2026-10-15-schumann-vp-customer-service.md). Finding F-001 (high).

3. What the model can do. The plan gives the model five tools: lookup_order, create_return, issue_refund, update_address, handoff_to_human. Flagging rests on the model alone: "The model will recognise abusive or suspicious chats and hand them off." No other mechanism is described (evidence/agent-proposal.md). Customer text is untrusted: "Customers already try 'your colleague already approved my refund' or paste in text that looks like one of our emails. My people check the order notes before acting." (interviews/2026-10-19-dvorak-support-team-lead.md). Finding F-012 (high).

4. Disclosure. "The assistant introduces itself." Wording, placement and frequency: to be decided. Marketing has proposed the name "Rosie" (evidence/agent-proposal.md). Clara Schumann: "I don't want 'I am a bot' on every message; Rosie should feel like one of our people." (interviews/2026-10-15-schumann-vp-customer-service.md). Fanny Mendelssohn: "I don't know what disclosure we owe them. That's for counsel." (interviews/2026-10-16-mendelssohn-governance-lead.md). Bizet & Brahms Home Goods ships across the U.S. (the evidence names Maine and Utah) and to customers in the EU (evidence/process-notes.md). Finding F-008 (medium).

The two human gates this record covers use the names and IDs in the requirements and architecture:

• Refund gate: G-2 "Refund above limit" (deliverables/01-requirements.md section 3; deliverables/03-architecture.md 3.5, "Refund gate"). Trigger: issue_refund amount above $100 (proposed; the client's agent owner confirms). Route: hold the refund; route to a team lead.
• Policy gate: G-3 "Policy" (deliverables/01-requirements.md section 3), with the policy library's approval gate (deliverables/03-architecture.md 3.4, "Approval gate"). The approval gate is the human step: a record becomes approved only when it has an owner, a version, an approved_by and an effective date (PG-1, PG-2, PG-5). G-3 is where it bites in a chat: no approved record covers the question, or records conflict, so handoff_to_human, with no answer from general knowledge (FR-9, PG-8). The architecture's approval gate has no G-ID of its own; it is expressed by PG-1, PG-2 and PG-8 together with G-3.

Not decided here. The off switch and release gate (G-7, NFR-4, NFR-5; F-002, F-003), logging (NFR-2; F-011), retention (TR-1 to TR-5; F-009, F-010) and what customer data each turn sends (DH-3; F-004) are covered in deliverables/01-requirements.md and deliverables/03-architecture.md. This record refers to them only where a choice below depends on them.

Part A: where policy answers come from

Part B: the refund limit and the two gates

Part C: the tool allowlist

Part D: disclosure

• Answers come only from approved policy versions (A3). The assistant answers only from approved, effective records in the policy library, one governing record per topic, each answer citing policy_id and version; everything else goes to G-3 "Policy" and a person. This is the only option that settles the 30, 45 and 14-day conflict by an owner's decision rather than the model's choice (F-005).
• Refund limit and the two gates (B3). issue_refund runs on its own only at or below $100 (proposed; the client's agent owner confirms), a parameter the tool gateway reads; above it, G-2 "Refund above limit" holds the refund for a team lead, as today. The policy library's approval gate admits a record only with an owner, version, approved_by and effective date, and G-3 hands off where no approved record covers the question. Both gates sit in code and in people, not in the model's instructions, so no chat message can move them (F-001, F-012). Whether to start with B4 (a person approves every refund at first) is for Clara Schumann to decide: unknown (to ask Schumann).
• Tool allowlist (C2). The five tools in the plan, and no others, behind a gateway that checks verification, the flag, the policy record, the packed status and the limit before any tool runs. The allowlist is a list the gateway reads, so Bizet & Brahms Home Goods can switch action tools off for a pilot (C3) without rebuilding; whether to: unknown (to ask Schumann) (G-7, pilot scope).
• Fixed disclosure text (D2). The disclosure is an approved, fixed text sent by the assistant service, not model output, so it can be checked by counsel, tested exactly and shown to have been sent. Its wording, placement and frequency wait for counsel's answer to Q-C1 and Clara Schumann's choice; this record decides the mechanism, not the words.

The value of the refund limit, the approvers, the policy owners and the disclosure wording belong to the client. This record proposes the mechanism they plug into.

Harder

• Nothing about policy can be answered until Mendelssohn's records are entered and approved. Owners, approvers and effective dates per topic: unknown (to ask Mendelssohn) (PG-4, PG-5, PG-7). Until then G-3 sends those chats to the shared inbox.
• Team leads take every refund above the limit. Dvořák has not been asked how that works with the assistant; the route is unknown (to ask Dvořák) (G-2).
• The assistant resolves fewer refunds than Schumann's plan intends. This is in direct tension with "Capping it at $100 defeats the purpose" and needs her decision on the value.
• The build carries a tool gateway and a policy release step the plan does not have (F-001 and F-012 estimate 1-2 weeks each inside the assistant build; estimates, the client confirms), against a launch date that is unknown (to ask Bizet) (NFR-8).
• Disclosure wording cannot be finalised until counsel answers Q-C1.

Open inputs this decision depends on

Revisit

• At sign-off (a later step): when the deciders accept or change this record. Status moves from Proposed to Accepted only then.
• When Clara Schumann confirms the limit, or later changes it: record the value and the date; if it rises above agents' current discretion (B5), record who decided and why.
• When Antonín Dvořák defines the G-2 route: check the route against AT-4 cases before G-7 opens.
• When counsel answers Q-C1: set the disclosure wording, placement and frequency, add the text to the test set, and revisit D2 or D3.
• Before G-7 opens: AT-1 to AT-6 meet their targets on the test set (deliverables/01-requirements.md section 8). A missed target keeps the assistant off.
• After launch, before widening autonomy: raise the limit, drop B4, or add tools only on test results and a period of action logs without incident (F-001, F-012). Length of that period and the review date: unknown (to ask Schumann).
• When the launch date is known: re-rate F-001, F-005 and F-012, which were rated on the plan as it stands (findings.yaml); date unknown (to ask Bizet).
• When a tool, a policy topic or the model version changes: amend the allowlist or the policy records through this record, and update the AI inventory (F-007; model version unknown (to ask Schumann)).

Sources. Requirements FR-1 to FR-3, FR-6, FR-8 to FR-19, G-1 to G-7, PG-1 to PG-8, DH-2, NFR-2, NFR-7, NFR-8, AT-1 to AT-6, Q-C1 (deliverables/01-requirements.md). Findings F-001, F-005, F-008 and F-012 (decided here); F-002 to F-004, F-007 and F-009 to F-011 (referred to) (findings.yaml). Evidence: evidence/agent-proposal.md, evidence/process-notes.md, evidence/policy-sources.md, interviews/2026-10-14-bizet-coo.md, interviews/2026-10-15-schumann-vp-customer-service.md, interviews/2026-10-16-mendelssohn-governance-lead.md, interviews/2026-10-19-dvorak-support-team-lead.md (all in evidence/index.md).

The client, its people and its town are fictional. This is a sample, not a case study.