Every BPO owner has been shown an “AI” that turned out to be a chatbot with a script. This page is the answer to that scepticism: the seven stages between a client’s process and a fleet that is allowed to touch it, and the evidence required at each one.
The fleet does not run on a model's general memory of eCommerce. It runs on three separate layers, and understanding the split is the whole point.
Rules — margin floors, refund ceilings, SLA windows, marketplace policy — live in code, in the action handler. A model cannot be persuaded past them because it is not the thing enforcing them.
Knowledge — the catalogue, the client's own policies, historical tickets, precedent — lives in a retrieval index scoped to your workspace alone. Agents answer from indexed documents belonging to your accounts, not from anything the model happens to recall.
Judgement — anything ambiguous, novel, or touching money, health claims or legal exposure — goes to your reviewer. Always, by design, not as a fallback.
The client's live process is written into a machine-readable operating spec: marketplace accounts and their policy sets, catalogue rules, margin floors, promotion rules, refund and return policy, SLA matrix, escalation policy, tone and brand guidelines. Every rule is traced to a client document or a signed-off decision. Nothing is inferred, and anything the client cannot answer is logged as an open item rather than guessed.
Catalogue master, SKU attributes and variant logic, brand guidelines, marketplace policy documents, historical ticket transcripts, the macro library and returns precedent are indexed into a retrieval layer scoped to your workspace. This is what gives an agent account-specific competence on day one instead of month three — it has already read every ticket the account ever raised.
Each agent is given four things: a scope defining what it may touch, tool bindings defining which panel actions and marketplace APIs it may call, an autonomy level deciding whether it acts or only proposes, and its encoded hard limits and escalation triggers. An agent physically cannot call a tool it has not been bound to. Permissions are the security model, not instructions.
Every agent runs against replayed historical tasks with known correct outcomes, drawn from the accounts it will actually serve. Accuracy is measured per task type, not as one headline number. No agent leaves sandbox until it clears its threshold on its own evaluation set. Every failure is traced to either a missing knowledge item or a badly stated rule, and fixed at source rather than patched in the prompt.
The fleet runs on live volume and publishes nothing. Every output queues for review. Your reviewer compares what the agent produced against what they would have done, and every disagreement goes back into the rule set or the knowledge index. This is where your team learns the fleet's behaviour and where the fleet learns your accounts — while carrying zero risk to the client.
Autonomy is released one task type at a time, lowest risk first: inventory sync, reorder flags, attribute completion. Draft-only comes off nothing that touches money, a published claim or a customer's legal position — those stay draft-only permanently. Each release is a decision with a name against it, recorded in the workspace log.
QC re-checks 200 random decisions every week. Every human overrule is logged with a reason and reviewed for pattern. Marketplace policy changes, catalogue changes and client rule changes are versioned updates to the operating spec, pushed to the fleet and re-evaluated before they take effect. Every decision and its inputs are retained for 24 months.
Inventory AI, Pricing AI, Returns AI, Ads AI, Forecast AI. These execute inside encoded limits and record every decision with its inputs. Nothing they do is irreversible, and everything is visible in the task centre as it happens.
Listing AI, Support AI, Refund AI, Compliance AI, Fraud AI. These produce a proposed action and stop. Nothing is published, sent or paid until a named person in your workspace releases it. This class does not graduate to supervised, however good the accuracy gets.
The distinction matters more than anything else on this page. An instruction in a prompt is a request. A check in the action handler is a refusal. These are the second kind.
Any vendor who will not answer this question is selling you something.
A fifteen-minute walkthrough of a live workspace: the fleet, the task centre, the review queue and what happens when an agent hits a hard limit.