Challenge
If an agent sends a bad email to one of our prospects, we lose the prospect
GTM Brain runs TechFabric's own outbound. That constraint changed how it was built in ways a client project never would have, because the cost of a wrong action lands on us the same week.
Drafting a plausible email is the part that demos well, and most demos stop there. It was maybe a fifth of the work. The rest is everything that has to be true on the hundredth day. A pass can run for hours, and if it dies halfway a contact can be marked as messaged when nothing went out, or messaged twice because a retry lost its place. Both are worse than never running at all.
An agent whose memory is a context window forgets an account between runs and relearns it badly, which is how a system ends up introducing itself twice. Approval gates that a deployment resets are decoration. And ten minutes is long enough for an account to be marked do-not-contact between a human approving a send and the send going out.
Strategy
Enforce in the pipeline, because a prompt is not a control
Asking a model to behave is not a governance mechanism. Every rule that matters had to live somewhere the agent can't reason its way around, which means the workflow engine, the data layer, or the permission model.
The second decision was to point it at our own pipeline before selling the pattern. A system we depend on gets tested by consequences rather than by a demo script.
Solution
Signals in, judgement under policy, a person on the switch
Durability. Temporal holds the workflow state, so a step that fails at three in the morning picks up where it stopped, and afterwards you can read exactly what happened.
Governed autonomy. Routine actions run on their own. Publishing, launching and sending need a tenant-issued grant scoped to the capability, which expires, and every send is revalidated at the moment it goes out whatever was true when it was approved.
Memory that outlives the process. Account state sits in Lakebase, so the system knows an account between runs.
Isolation. Every organisation's data is scoped in the data layer. A missing WHERE clause in application code is a leak; in the data layer it is a query that returns nothing.
Approval that survives a deploy. A workflow can wait days for a human signal and resume from exactly where it paused.
Unity Catalog decides access, and the App runs in the workspace under its own service principal, so the workloads sit next to the governed data and nothing leaves the boundary to be reasoned about elsewhere.
Results
A production agent we depend on, and a pattern that transfers
GTM Brain runs our own pipeline in production. When a buyer asks whether we have actually put one of these into production, the answer is a workspace we can open and a system doing something we rely on.
The shape generalises. Swap outbound for claims triage, underwriting review or contract intake and the architecture holds: signals in, judgement under policy, durable execution, an audit trail, and a person holding the switch on anything that leaves the building. It is the same pattern we bring to client work, tested first where a mistake costs us our own pipeline.