Audit, provenance, human-in-the-loop

Demo vs system

An agent that answers in a chat and leaves no trail looks clever for five minutes. Then someone asks: who changed the rate, from which utterance, under whose authority? Silence. That is a demo.

A system can reconstruct every material action: who proposed it, who confirmed it, when, why, and from which source fragment. Without that lane you do not have AI over operations — you have plausible text next to a live business.

Three things that must travel together

Audit is the immutable journal of actions. Provenance is the link from a CRM field or a warehouse fact back to the raw evidence. Human-in-the-loop is the role that may promote a draft into the system of record.

Drop any one of them and the other two rot. A log without provenance is a timeline of shrugs. Provenance without a human gate becomes auto-fiction. A human without a log is tribal knowledge.

• Who proposed / who confirmed
• When the decision landed
• Why this rule or metric fired
• Which source fragment justified the value

Same discipline for TMS and the warehouse

People treat call writeback and data loads as different tribes. They are not. A rate extracted from a call and a margin loaded from ERP both enter a system of record. Both can poison decisions if the path is opaque.

One standard: no silent writes on day one; every extract carries origin; raise auto-confirm only when eval numbers allow it. Domino card, CRM field, mart row — same contract.

What “human in the loop” is not

It is not a rubber stamp after the fact. It is a role with authority before the write: curator confirms a rate, analyst signs a baseline, owner accepts a Go / No-Go. The UI must make refuse as cheap as accept.

If the only path is “click through the banner”, you built theatre with a checkbox. If refuse is logged with a reason, you built learning data.

What to demand before you buy

Ask for the audit record of one bad suggestion. Ask how a wrong warehouse load is traced to the source file and the transform version. Ask who can raise auto-confirm and on which metric.

If the vendor answers with a model name instead of a journal schema, walk away. Models are replaceable. Accountability lanes are not.

Bottom line

An agent without a trace is a demo. Audit, provenance and a human gate are the operating system under the model. One logic for TMS writeback and warehouse loads — or you will relearn the same failure twice.