Four agent systems, described by what they do.

A regional developer was screening land acquisitions on instinct and a spreadsheet. The agent handles the first pass. It mines public county GIS for parcel geometry and ownership, models subdivision feasibility, and identifies which utility is legally obligated to serve each parcel. The off-market target lists come from criteria no listing service exposes: large acreage, deeded decades ago, owner's mailing address in another city, near-zero improvement value.

Then we backtested it, and the model was wrong. Run against two completed subdivisions and thirty-three closed lot sales, the first version overstated road take by up to 1.9×, per-lot development cost by 3.35×, and absorption pace by 1.44×. Uncorrected, it would have killed good deals and approved bad ones with equal confidence.

None of that surfaces from a demo. It surfaced because the model was made to predict outcomes that had already happened, where being wrong was checkable.

Built for a consultancy whose real problem was engagement, not a shortage of prospects. They had no defensible way to decide who to call today. The system watches a defined market for the events that create an opening, then each morning returns a handful worth a call: who to ring, why now, and a specific opening line written for that person's role.

Every score opens up: the reasoning, what changed at the company in the last twelve months, how their marketing compares to competitors, and the buying group with a recommended order of approach. Three buttons feed back into the ranking, so it gets more accurate as it's used.

A daily agent run that discovers candidates from defined sources, deduplicates against everything already known, verifies each is still live, scores it against a published weighted model with a recommendation floor, and persists the full breakdown as one record: score by factor, fit, material gaps, sources, and the reason for recommending or excluding. Every rejection the user writes becomes a derived screening rule, so the system's judgment converges on theirs.

The guardrails are written into the spec, not left to inference. The system never submits, never contacts a third party, and never files anything with the agency it documents for. It produces evidence; a human decides and acts. Stating that in the documentation is the only way a boundary survives a rebuild.

A research corpus of 610 verified sources across six subjects, in Postgres, with the discipline that separates a defensible knowledge base from "we loaded your documents into a vector store." Deduplication runs by publication identifier, then DOI, then normalized URL, because the same paper reaches you three different ways.

Each source carries relation labels so evidence about a parent compound, a class, or a structural analog is never silently read as direct evidence. That distinction is invisible in a naive retrieval setup, and it's exactly what makes a generated summary wrong in a way nobody catches. Writes go through one sanctioned function that enforces the rules; integrity was confirmed three independent ways.

The same architecture underlies any internal assistant that has to answer from your own content and be trusted when it does.