Sign-off record: design phase of the proposed customer support assistant (ENG-D004)

Approval covers the documents as they stand on 2026-11-02, with the two decisions in section 4. Where documents 01 to 05 and the controls design show the refund limit as proposed, decision 1 below now governs; those documents are not reissued for it. Every item those documents mark "unknown (to ask <who>)" or <client decides> stays open until the named person answers (section 6). Approval does not answer any of them. References in deliverables/05-findings.md and deliverables/controls-design.md to ADR-001 as Proposed, or to the controls design as not yet approved, are superseded by this sign-off (section 2 and decision 2); the accepted ADR-001's "$100 (proposed; the client's agent owner confirms)" wording is superseded by Clara Schumann's acceptance of $100 recorded in decision 1 below; documents 01 to 05 and ADR-001 are not reissued.

Antonín Dvořák, Support team lead, is named in ADR-001 as a decider for the refund gate route. He is not a signer of this record. How team-lead approval works with the assistant stays open with him (section 6).

Decision 2. ADR-001 is accepted. ADR-001 moves from Proposed to Accepted on 2026-11-02. The accepted decision is the one the record proposed: options A3 (answers only from approved policy versions), B3 (code-enforced refund limit with a team-lead gate), C2 (fixed allowlist of the five tools behind a tool gateway) and D2 (fixed disclosure text). The status line in deliverables/04-adr-001-human-gates-and-tool-allowlist.md has been updated to say so. Acceptance does not settle what ADR-001 leaves open: whether every refund needs a person's approval at first (option B4), the pilot scope, and the disclosure wording, all listed in section 6.

(a) The evaluation targets are met on the test set before the release gate G-7 opens. The targets are those in deliverables/01-requirements.md section 8, as written there:

The release rule in the requirements stands: a missed target blocks release. G-7 as defined in the requirements also requires the off switch (NFR-4) to have been tested (NFR-5); this record does not remove that.

(b) The gates are built as in ADR-001. The refund limit and the G-2 hold, the policy approval gate with G-3, the tool allowlist and its preconditions in the tool gateway (G-1, G-4, G-5), and the fixed disclosure text are built in code and in people, not in the model's instructions, as ADR-001 decides and the controls design specifies (C-01 to C-04, C-13).

Clara Schumann, as agent owner, approves release in writing against a dated scorecard (controls design C-05). Release then starts with a pilot smaller than all website chats; the pilot scope is still open (section 6).

Clara Schumann, VP of Customer Service

• Should every refund, inside the limit too, need a person's approval at first (ADR-001 option B4), and for how long?
• What name will the assistant use (marketing proposed "Rosie"), and what disclosure wording, placement and frequency, once counsel has answered Q-C1?
• Do create_return and update_address need approval beyond G-1, G-4 and G-5 (G-6)?
• How does the assistant learn that an order is packed (FR-15)? Does lookup_order return order notes (FR-17)? May a verified customer see orders other than the one verified (FR-7)?
• What customer data does each turn actually need (DH-3)?
• Who is the named person, and the backup, who can switch the assistant off, and what is the target time from decision to effect (NFR-4)?
• What is the pilot scope, and which tools are on at launch (G-7)?
• Does the 45-day "holiday extension" still apply (PG-7)?
• Who builds and runs the assistant? Which system is the order store? How does the assistant connect to the website chat and shared inbox? Where is the lineage log stored? Does a test order environment exist?
• How long is the incident-free period before widening autonomy? Who watches the vendor's notices? What sample size and schedule apply to the post-launch chat review? Where are customer complaints recorded, and what do the client's customer terms say about telling customers of an incident? Which model version will be used?

Fanny Mendelssohn, Data and AI Governance Lead

• Who owns, and who approves, the policy record for each topic (returns, refunds, shipping, address changes, damaged items), and what are their effective dates (PG-4, PG-5, PG-7)?
• What data classification scheme and labels apply to each data item that crosses the model boundary (DH-1)?
• What is the transcript retention period, and who decides it (TR-1)? Can the help-desk tool delete on a schedule?
• What retention options does the API account offer, and which is chosen (DH-4, TR-4)?
• Who owns the help-desk "suggested replies" feature (AI-002)? Can the help-desk tool mark AI-drafted replies or require an edit before sending?
• Who masks test chats, and how?

Antonín Dvořák, Support team lead

• How does team-lead refund approval work with the assistant, where do held refunds appear, and what is the customer told while a refund is held (G-2)?
• What counts as "suspicious" (FR-20)?
• Can his team supply masked example chats for the test set?

Georges Bizet, COO

• What is the API cost cap, and over what period (NFR-1)?
• What are the handle-time baseline and target (NFR-7)?
• What is the launch date (NFR-8)? The findings re-rated once it is known are F-001 to F-005 and F-012, as listed in 02-risk-classification §6.

Bizet & Brahms Home Goods (client decides)

• Every threshold, sample size, period and time limit marked <client decides> in the controls design.

Questions for Bizet & Brahms Home Goods' counsel (as worded in deliverables/01-requirements.md section 9; for review by the client's counsel; Touchstone Data gives no legal opinion on them)

• Q-C1. What disclosure that the assistant is automated is owed to customers in the EU and in the U.S. states Bizet & Brahms Home Goods ships to (the evidence names Maine and Utah), and does the approach Schumann prefers (no "I am a bot" on every message) meet it?
• Q-C2. What do the provisions of Anthropic's Commercial Terms of Service on customer data, retention and training mean for this use, and is a data processing addendum needed?
• Q-C3. May chat transcripts be kept indefinitely and used as training data, as Schumann proposes?
• Q-C4. Does sending EU customers' name, email, shipping address, order history and order status to the API on each turn need anything further?

The controls design also puts two further questions to counsel: whether any hold applies before existing transcripts are deleted, and whether any reporting duty applies to an incident.

Executive sponsor

Agent owner

Governance