Workflow designs from delivered work
The designs sit on the four stages of an engagement. Discovery reads the system; Build puts code into production inside a two-week sprint; Deployment goes live without stopping the operation; Trust is the approval gates, audit trails and reconciliations that let an auditor follow every record.
The 10 designs
- Document intake: paper to a posted receipt
- Governed AI workers: read freely, write only through a person
- The context packet: pre-flight queries before any model call
- Two-model consensus: independent readings before a draft is proposed
- Voice intake: a phone call that ends as a scheduled work order
- Single entry point: one governed router for every transaction save
- The diligence read: telemetry first, interviews last
- Live cutover: dock to ledger with lot traceability
- Design-change portal and invoicing on the carrier scan
- The revenue spine: HubSpot, Stripe and NetSuite reconciled to the cent
No design matches that combination. Clear a filter.
Document intake: paper to a posted receipt
Where it runs: Receiving docks and AP desks in manufacturing and distribution; packing slips with heat or lot numbers, carrier bills, vendor invoices
A packing slip or vendor bill arrives as a PDF, a scan or a phone photo. A vision model reads it, SuiteQL resolves the vendor, the parts and the open purchase-order lines, and the worker proposes an item receipt or vendor bill with its lot subrecords. A person approves; nobody re-types a heat number.
01Capture
- Packing slip, bill of lading or vendor bill arrives by email, scanner or phone photo
- File lands in the intake queue with sender and timestamp
- Duplicate check by content hash against prior documents
02Extraction
- Vision OCR normalizes multi-page PDFs and photos
- Header, lines, quantities, heat or lot numbers, expiration dates
- Confidence per field; low confidence is flagged, never guessed
03Resolution in NetSuite
- SuiteQL match: vendor name to entity ID
- Vendor part number to item through the alias history
- Open purchase-order lines pulled for the three-way match
04Proposal
- Draft item receipt or vendor bill with lot subrecords
- Line variances computed against the PO
- Evidence packet: source page, extracted values, matched records
05Approval and posting
- Exact PO matches queue for one-click approval
- Variances open with the PDF beside the draft
- NetSuite writes the record under the approver’s role
Control points
- Nothing posts without a named approver. The approval is one click; the keying is gone.
- An idempotency key on every draft prevents a second receipt when a document is re-sent.
- Field-level confidence and source-page references make every line auditable after the fact.
Governed AI workers: read freely, write only through a person
Where it runs: Multi-subsidiary services holding company; enterprise managed services and complex logistics
A central router dispatches work to specialized workers, each acting only through formal Model Context Protocol tools: parameterized read-only SuiteQL, record schema, and a draft proposal. Reads return live rows. Writes stop at a review modal where a supervisor approves before NetSuite commits the record.
01Inputs
- Vendor PDF bills through OCR
- A natural-language question from the CFO
- The scheduled nightly diagnostic
02Central router
- Agent dispatcher and state machine
- Context from the corporate knowledge base
03Specialized workers
- AP matching worker
- GL margin-leak detector
- SuiteQL forensic auditor
04Governed MCP tools
- execute_suiteql, read-only
- get_record_schema
- propose_transaction_draft
05Production ledger
- Reads return live SuiteQL rows
- Drafts stop at the human approval modal
- Approved drafts commit to the ACID ledger
Control points
- Role-scoped tokens and a read/write boundary an auditor can inspect; no scrapers, no shared database drivers.
- Every figure in a worker’s answer traces to a SuiteQL row it did not generate.
- A worker can find fourteen duplicate invoices in five thousand purchase orders; it cannot post a credit for any of them.
The context packet: pre-flight queries before any model call
Where it runs: Any AI worker that touches entities, currencies or tax: AP matching, margin-leak detection, finance questions over the ledger
Commercial models fail inside an ERP when they are asked to remember internal IDs, tax nexus and currency rates across a long context. This design never asks them to. Code runs the queries first and hands the model a small, structured packet of live rows for the one task in front of it.
01Trigger
- An inbound document, a question from finance, or the nightly diagnostic
- The router classifies the task and picks the worker
- The worker’s required context is declared, not improvised
02Pre-flight SuiteQL
- Parameterized, read-only queries for exactly the rows needed
- Entity, open PO lines, currencies, tax nexus, item aliases
- Results cached for the run; no saved searches in the loop
03Context packet
- Compact structured packet with record internal IDs
- Personal data masked before it leaves the tenant
- Every value tagged with its table and row
04Model reasoning
- The model reasons over the packet only
- Each figure in the output traces to a packet row
- Unknowns come back as questions, not guesses
05Memory
- Resolved aliases and decisions written to the knowledge base
- The next run starts from the corrected mapping
- A correction by a person becomes a rule the worker follows
Control points
- The packet builder holds read-only, role-scoped credentials; it cannot write.
- Masking and row tagging happen in code before the model is called, so the model never sees a name it does not need.
- The packet is logged with the prompt hash, so any answer can be replayed and checked.
Two-model consensus: independent readings before a draft is proposed
Where it runs: Accounts payable and any intake where a model’s reading becomes a ledger entry: vendor bills, credit memos, contract terms
One model’s reading of an invoice is an opinion. Two independent readings compared by code against the purchase order are evidence. The gate proposes a draft only when both readings agree and match NetSuite; any disagreement becomes an exception with both readings side by side, and no path leads from either model to the ledger.
01Independent extraction
- Model A extracts header, lines, quantities and lot serials
- Model B extracts the same document with no view of A
- Both return structured output against the same schema
02Deterministic comparison
- Code compares A and B line by line
- Totals recomputed from the lines, not read from the page
- Terms, duplicate invoice numbers and tax codes checked against NetSuite
03Outcome
- Agreement to the cent and a PO match: a draft is proposed
- Any disagreement: an exception with both readings side by side
- No path from either model to the ledger
04Human approval
- The approver sees the draft, the evidence and the variance
- One click approves; one click sends it back
- The record saves under the approver’s role
05Audit trail
- Prompt hashes and model versions in the system notes
- Both readings retained with the document
- Approval stamp and timestamp on the transaction
Control points
- Agreement is decided by code with fixed tolerances, not by a third model.
- The tolerance that lets an exact match queue for one-click approval is a setting the controller owns.
- Model vendors are interchangeable; the gate is the design, not a particular model.
Evidence and related pages
Voice intake: a phone call that ends as a scheduled work order
Where it runs: Field-service and installation businesses whose calls arrive after hours; the same pattern answers the multilingual agent on this site
A caller reaches a conversational agent instead of voicemail. The agent discloses what it is, captures the customer, site, issue and urgency, checks the account and the schedule in NetSuite by read-only calls, and drafts a service order with a held slot. The dispatcher releases it; exceptions go to a person with the transcript.
01Call
- Inbound call, including after hours
- The caller is told it is an AI agent and consent is recorded
- Language detected; the agent answers in it
02Conversation
- Streaming speech to text and back
- Intent and facts captured: customer, site, issue, urgency
- Unknowns are asked, not assumed
03Read-only lookups
- Customer and site matched in NetSuite by phone, name and address
- Contract or warranty status, open orders, last visit
- Technician availability from the schedule
04Proposal
- Draft service order with the captured facts
- Proposed slot held, not booked
- Confirmation read back to the caller
05Confirmation and handoff
- Text or email confirmation to the caller
- The dispatcher reviews the queue and releases the slot
- Exceptions and callbacks go to a person with the transcript
Control points
- Disclosure and consent open the call; the transcript stays with the order.
- Every NetSuite call during the conversation is a read. The write is the dispatcher’s action.
- Hold, do not book: a slot is reserved for review so two callers never claim the same hour.
Evidence and related pages
Single entry point: one governed router for every transaction save
Where it runs: NetSuite accounts where a stack of user-event scripts fires on every save: distribution, manufacturing, subscription billing
A dozen scripts on one record type run in an order nobody chose, each loading searches on the user’s thread, and the save freezes or collides. The single entry point replaces the stack with one typed router: synchronous work is in-memory validation, and everything heavy runs behind the save in an idempotent queue.
01Record event
- Sales order, item receipt or invoice saved from the UI, a RESTlet, a CSV import or EDI
- One deployment per record type replaces the stack of user-event scripts
- Context captured: role, source, record state
02Router
- Typed dispatch by record type and event
- Deterministic rule order, declared in code
- A feature flag per rule for safe rollout
03In-memory validation
- Rules evaluated against cached reference data
- No saved searches or record loads in the save path
- Reject early, with a specific message
04Queue
- GL allocations, credit checks, EDI dispatch and notifications queued
- An idempotency key per job; retries are safe
- Map/Reduce workers drain the queue with governance headroom
05Ledger and telemetry
- The save returns in well under a second in the published retrospectives
- Record-lock collisions fall away with the synchronous work
- Timing per rule logged for the speed benchmark
Control points
- One place to read the rules, so an auditor can see every side effect of a save.
- Synchronous code may not call a search; the deployment lint fails if it does.
- Queued jobs are idempotent and replayable. A failed job is retried, never duplicated.
The diligence read: telemetry first, interviews last
Where it runs: Private-equity targets and newly acquired portfolio companies on NetSuite; also the first step of every DataOngoing engagement
A conventional discovery interviews people for weeks and delivers a deck. This design reads the system: a read-only role, SuiteQL over execution logs, scripts, searches, roles and integrations, and a dependency map with findings ranked by exposure. The read-out comes 48-72 hours after access, and the fee is credited to the first sprint.
01Access
- A read-only role granted by the target’s administrator
- Scope agreed: scripts, searches, roles, integrations, transaction volumes
- No workshop, no interview schedule
02Extraction
- SuiteQL over script deployments, execution logs and governance usage
- Saved searches, workflows, custom records and their owners
- Roles and permissions scored on the 0-4 Role Risk Index
03Analysis
- Hot paths: the scripts on the save path and their timing
- Lock collisions, N+1 searches, unindexed criteria
- Integrations and middleware, with their failure modes
04Architecture map
- Dependency map from record type to script to integration
- Findings ranked by dollar exposure and effort to fix
- What the read cannot see, stated explicitly
05Read-out
- A written report and a read-out with the deal team
- A sprint roadmap with fixed prices
- The read fee credited in full to the first sprint
Control points
- Read-only access; nothing in the target changes during diligence.
- Every finding cites the log row, script ID or role it came from.
- The report states what it could not observe, so a finding is never inferred from silence.
Live cutover: dock to ledger with lot traceability
Where it runs: $70M West Coast perishable food and beverage distributor; cold-chain food and perishable beverage distribution
Physical intake is decoupled from accounting. Scanners post to an idempotent staging RESTlet and are released in under a second; a Map/Reduce worker binds lots and expiration dates, accrues landed cost and releases the SKU to the pick wave. The move off the legacy platform ran as idempotent delta ingestion across a shift change.
01Inbound receiving
- Refrigerated truck at the dock
- Mobile RF scan of the pallet tag
- Capture vendor, SKU, lot, expiration, weight
02Staging engine
- Idempotent RESTlet staging queue
- Atomic subrecord validation
- Valid: staged item receipt in under 800 ms
- Variance: hold in a QA quarantine location
03Asynchronous lot and GL engine
- Map/Reduce allocation pipeline
- Bind lot numbers to FIFO inventory subrecords
- Accrue estimated freight landed cost
- Release the SKU to the pick-and-pack wave
04Governed financial core
- Debit inventory asset, lot-specific
- Credit landed-cost clearing accrual
- Actual carrier bill matched to the lot when it arrives
Control points
- A retrying scanner updates the same staging record; it never creates a second pallet.
- Lot and expiration subrecords are validated at the moment of physical entry, when they can still be corrected.
- Variances hold in a quarantine location instead of blocking the dock.
Design-change portal and invoicing on the carrier scan
Where it runs: $90M engineered filtration and HVAC systems manufacturer; industrial equipment and engineered filtration manufacturing
A design change is a commercial event. A Suitelet logs it, locks the production ticket, reprices against material cost and waits for the project manager’s approval before updating the sales order and work orders in one transaction. Invoicing becomes an event too: the carrier scan triggers verification, posting and dispatch of the invoice.
01Before: fourteen business days
- Shop floor ships the equipment
- Paper traveler packed with the unit
- Design changes tracked in a shared spreadsheet
- Manual billing review in NetSuite
- Invoice created 12-14 business days later
02After: under two minutes
- ShipStation carrier scan
- Fulfillment webhook into NetSuite
- Paired engine verifies milestones and DCR approvals
- Invoice generated and posted to the GL
- Electronic invoice dispatched to the customer
Control points
- A logged change locks the downstream production ticket until it is approved or withdrawn.
- The sales order, work orders and invoice are linked programmatically, so an auditor traces a line without a spreadsheet.
- Invoices post only after fulfillment, approvals and terms are verified by the job, not by a clerk.
The revenue spine: HubSpot, Stripe and NetSuite reconciled to the cent
Where it runs: High-growth B2B SaaS and subscription business; b2b software and tech-enabled services
Commercial terms are captured once in the CRM. A closed-won deal provisions the customer, the sales order and the Stripe subscription; each payment webhook posts gross, net and fee as one entry; the ASC 606 arrangement is created on deal close. Every payload is hashed against the Stripe event ID so a retry posts nothing twice.
01HubSpot
- Deal marked closed-won
- Payload: terms, products, seats
02NetSuite provisioning
- Validate tax ID, currency, subsidiary
- Create the customer and sales order
- Create the Stripe customer and subscription schedule
03Stripe
- Charge the card or dispatch the invoice
- Webhook: invoice.payment_succeeded with gross, fee and transaction id
04Settlement engine
- Debit Stripe clearing for the net deposit
- Debit processing-fee expense
- Credit accounts receivable for the gross
05Revenue engine
- Create the revenue arrangement and fair-value allocation
- Post the monthly deferred-revenue journal
Control points
- The gateway fee is split at ingestion, so the bank deposit matches to the cent the day it lands.
- Webhook deduplication by event ID: a duplicate returns success to Stripe and posts nothing.
- Sales reps never own tax codes or exchange rates; the translation into accounting rules is code.
Modeled composites: each design is drawn from delivered work with the client shown as an archetype. Figures live on the linked case studies and the 100x time ledger, each with a source class. How the designs are built and billed: how we work.
Frequently asked questions
Are these the actual diagrams from the engagements?
They are redrawn. The working diagrams carry client names, staff names and account details, so the architecture is published as native lane diagrams with the client shown as an archetype. The stages, handoffs and approval points are the ones that ran.
Do the AI designs write to NetSuite on their own?
No. Every AI design here reads through governed, read-only tools and proposes drafts. A named person approves, and NetSuite writes the record under that person’s role. The approval is one click, but it is a person’s click.
Where are the numbers?
On the linked case studies and the 100x time ledger, each with a source class. The diagrams themselves carry no figures beyond what those pages already publish.
Can one of these be adapted to our stack?
That is what a two-week sprint is for. The diligence read, 48-72 hours from access, shows which design fits and what it would move; the sprint delivers it as code in production, and the read fee is credited in full to the first sprint.
Talk to the architect, not a salesperson
Aissistor technology for NetSuite: the five roles a company pays for, absorbed into one governed box at a modeled 20-80% lower cost, with the existing team repurposed rather than replaced, and every outcome published in a 100x time ledger with its source class. Read the ledger.
Schedule a strategy call Run the five-role calculator
The direct email and phone number are shared in the receipt of a verified request.