I built a control plane for AI support agents instead of another chatbot — looking for architecture feedback

I’ve been working on RelayOps, a production-shaped prototype for AI support-agent control. The main idea is that an AI support agent should not directly perform real-world actions just because the model said so. The architecture is built around this invariant: The model proposes. The broker decides. The action envelope wraps the request. The tool boundary executes only allowed scoped actions. High-risk actions require human approval. The audit trail records every state. Replay verification checks consistency. Hermes reviews traces, but remains read-only/advisory. A human/operator stays accountable. What I built: scoped customer/auth datastore bearer-token auth + rate limiting policy broker action envelope MCP-style tool boundary replay verification operator metrics Hermes alerting redacted ticket import/report workflow human approval queue approval console + audit export end-to-end scenario runner pilot-readiness docs The public demo uses only synthetic/sample data. No real customer data. No production users. No real vendor integrations. No refunds/payments/outbound actions. No hidden production credentials. The part I’m most interested in feedback on: Is this the right control-plane shape for AI support agents? Especially around: where the broker should sit how replay should be used how high-risk actions should be approved what audit evidence would matter to an operator what is still missing before a real pilot I’m not claiming this is production SaaS. It is a production-shaped prototype and architecture reference. Feedback on the design would be helpful.