The travel assistant of Nordlicht Reisen GmbH promises nothing binding (R-02). Refunds, legal questions and blocked accounts go to a person. Now it is supposed to do more: read bookings through a tool and, later, trigger rebookings. At the same time a second agent, the pruefer (E-03), is supposed to read every draft against its sources before a customer sees it. The lesson asks who controls the agents, who brakes them and what happens on an error.

Prior knowledge. "AI track, lesson T7.3" shows approvals with ApprovalRequiredAIFunction and the session overnight, "T7.4" workflows made of executors and edges with checkpoints, "T7.6" the five patterns, the reviewer agent and why cost, errors and waiting time grow with every agent, "T6.4" hard rules in code before the model. New here is the Foundry side: where the agents live, how the service demands an approval, what Learn says about workflows and hosted agents.

New in this lesson. The pruefer is a prompt agent in the project reiseassistent and answers only with JSON {"ok": …, "befunde": […]}. The sources belong to the draft text. The assistant gets the made-up MCP server buchungen with the read-only tools buchung_lesen and reise_suchen.

The requirement

All numbers are assumptions of the exercise.

No. Requirement Type Measure Weight Source
2.5-01 Every draft of the assistant is read by the pruefer before a customer sees it. F 100% of the answers Must Quality
2.5-02 Refund, legal question, blocked account: no model call, a person (R-02). R 0 model calls Must Legal
2.5-03 Read-only tools run without asking, changing ones only after a person's approval. R 0 write calls without approval Must Security
2.5-04 A verdict of the reviewer that cannot be read never approves. R A failure leads to "held back" Must Security
2.5-05 At most two model calls per answer. Q 2 calls; assumption Should Cost (R-09)

Cost frame. Cost drivers: tokens per million, per model call; for hosted agents additionally the compute time of the container. Prices: Foundry pricing page.