Agent automation can move too quickly
A model saying approved must not become operational authorization.
WebMCP-native logistics control
AI can plan the load. Only a human can authorize it.
LoadGuard gives a WebMCP agent structured access to inspect a truck, build and validate a deterministic 3D loading plan, and stage it for review while the application and database prevent execution until a human approves the exact proposal.
Production deployedWebMCP verified
The agent reasons. The operator authorizes. The website defines and enforces the contract.
Production workspace
STAGED - human approval required
7 WebMCP tools
Deterministic planning
Database-enforced approval
3D load visualization
Production deployed
The problem
Giving an agent tools is easy. Giving it authority safely is harder.
DOM automation is brittle
Agents need structured capabilities instead of guessing page state from labels.
Human review can drift from execution
The operator must approve the exact proposal that will later execute.
Operational retries can duplicate consequences
Commit needs idempotency, revision checks, and database-enforced state transitions.
The control model
The agent and operator have deliberately different powers.
Agent
- Inspect truck
- Inspect constraints
- Create deterministic candidate
- Validate candidate
- Stage proposal
- Attempt commit
- Read audit ledger
Cannot approve itself.
Human
- Review exact staged plan
- Inspect warnings
- Approve proposal
- Reject proposal
Approval itself does not mutate truck state.
Database authority
Execution has to prove authorization.
approved hashexpirysessiontruck revisiontarget coverageidempotency
Workflow
From inbound package to authorized execution.
Inspect
Agent reads TRK-042, the active truck load, and package constraints.
Plan
A deterministic planner creates a complete candidate load.
Validate
An independent validator checks hard loading constraints.
Stage
The agent stages an immutable proposal for human review.
Block
Commit before approval returns APPROVAL_REQUIRED.
Authorize
The operator approves the exact staged proposal in the UI.
Execute
The database verifies authority and updates active load state.
Judge scenario
One package demonstrates the entire safety contract.
Current
TRK-042
8/9 loaded, MED-901 inbound, 993/1200 kg, 75.6%, revision 1
Agent proposal
Valid candidate
9/9 placed, 1011 kg, 78.4%, 0 hard violations
Human gate
APPROVAL_REQUIRED
Commit is blocked until the exact proposal is approved.
Execution
EXECUTED
MED-901 loaded, active revision 2, duplicate commit blocked.
Spatial workspace
The proposal is visible before it becomes real.
Active packages
Solid cargo represents the truck's current operational state.
Candidate proposal
Cyan translucent cargo shows what the agent wants to stage.
Fragile and urgent
Handling constraints remain visible before authorization.
No silent mutation
The active load does not change until an approved commit succeeds.
WebMCP
Seven narrow tools instead of one dangerous super-tool.
| Tool | Purpose | Consequence |
|---|---|---|
| get_load_state | Inspect truck state | READ ONLY |
| get_package_constraints | Inspect package constraints | READ ONLY |
| create_load_plan | Build candidate plan | CANDIDATE |
| validate_load_plan | Validate candidate | CANDIDATE |
| stage_load_plan | Stage immutable proposal | CANDIDATE |
| commit_load_plan | Apply approved proposal | OPERATIONAL |
| get_action_ledger | Inspect audit events | READ ONLY |
Human approval is intentionally not a WebMCP tool.
Commit accepts a proposal identifier. The server and database decide whether execution is authorized.
Explore WebMCP architectureTrust by construction
The safety boundary lives in application state, not model text.
Exact-plan approval
Human approval is bound to the canonical staged proposal hash.
Revision protection
Stale proposals cannot execute against a newer truck revision.
Expiry
Old proposals lose authority instead of lingering indefinitely.
Session isolation
One operator session cannot authorize another session's proposal.
Idempotency
Executed proposals cannot mutate the active load twice.
Auditability
Agent, human, system, and blocked actions are recorded without chain-of-thought.
Structured capability
The agent does not have to guess where the button is.
DOM-style automation
- 1Find element
- 2Interpret labels
- 3Infer page state
- 4Click UI
- 5Hope state matches
LoadGuard WebMCP
- 1get_load_state
- 2create_load_plan
- 3validate_load_plan
- 4stage_load_plan
- 5commit_load_plan
WebMCP Challenge
The proof is visible, testable, and deployed.
Production
Cloudflare Workers
Live deployment available now
WebMCP
document.modelContext
Exactly 7 registered tools
Database
Supabase
RLS plus protected authority RPCs
3D
React Three Fiber
Active and candidate cargo visualization
Validation
Deterministic
Independent planner and validator checks
Quality
28 tests
Build, typecheck, lint, and tests verified
Final proof
Let the agent plan. Keep authority human.
Inspect the live judge scenario, stage a deterministic candidate, and see the execution boundary enforced by the application itself.