Don’t trust
the agents. Control them.
HeptaFlow runs AI agents under contract, independent review and recorded evidence — and leaves the decisions that matter to people. Nothing is accepted on an agent’s word.
- 01 IntentContract
- HEPTAFLOW CONTROL — CONTROL BOUNDARY
- 02 Execution · agent ABuilder
- 03 Review · agent BReviewer
- 04 ChecksDeterministic
- 05 EvidenceRuntime proof
- 06 AuthorityHuman
Agents work only inside a boundary that HeptaFlow Control owns: a contract going in, independent checks and evidence inside, human authority on the way out.
Reconstructed view with synthetic data · read the run as text
- The control boundary. Agents work only inside a boundary HeptaFlow Control owns: a contract going in, independent checks and evidence inside, human authority on the way out.
- Enter HeptaFlow Control. The same structure as the platform shows it: a Flow of agent, script and human tasks. Each card is runtime state (planned, ready, running, completed), not a drawing.
- An agent builds, inside limits. The Builder is an agent with a fixed role and pinned inputs. HFC starts it in an isolated workspace, owns its timeout and retries, and records the attempt. The agent never routes the Flow.
- An independent reviewer objects. The Builder reported its work built and the rule-based check passed. The reviewer, an agent from a different provider, found a defect with file and line. Its verdict routes the work back to the Builder (RECURSION).
- Bounded, recorded rework. The Builder receives the finding and changes only what it cites; the reviewer re-checks the changed file and confirms the fix. Both engines run and a program compares every row. Rework is bounded. When a task fails or the budget is spent, HFC stops and waits for a person.
- The decision stays human. Every attempt, check, finding and comparison is retained for this candidate. Here the Analyzer could not prove one case, so the run waits for Human Review: accept, or send it back. Where the human decides is defined per Flow; in HeptaFlow’s own engineering lifecycle, acceptance and closure are always explicit human decisions.
The product views are a reconstruction of the HeptaFlow Control interface with synthetic data, not a recording. Simplified: six deterministic stages of the real Flow are not shown. Provider names are the agent identifiers HFC displays.
Agents are fast. Acceptance is the hard part.
Autonomous agents can produce code, SQL and pipelines in minutes. Enterprise engineering still has to answer the same questions it always did: is it right, who checked it, and can we prove it?
Confident ≠ correct
An agent reports success with the same certainty whether it is right or wrong. Its own summary is not evidence.
Review doesn’t scale
When output grows tenfold, line-by-line human review becomes the bottleneck — or quietly stops.
Nothing to audit
Prompts, context and decisions vanish with the session. What cannot be reproduced cannot be governed.
Control you can inspect.
HeptaFlow Control is the control layer around the agent. It fixes what must be done, what the agent works with, and what counts as proof. The AI provider supplies the intelligence; HeptaFlow supplies the control; you keep the authority.
| P-1 | Verifiable contracts | Every requirement names, in advance, the evidence that confirms or refutes it. |
|---|---|---|
| P-2 | Pinned context | Agents work from approved, versioned inputs, recorded per attempt. |
| P-3 | Isolated execution | Each run works in its own workspace; HFC owns start, timeout, retry and stop. |
| P-4 | Independent review | A second agent from a different provider reviews the exact result before it moves on. |
| P-5 | Retained evidence | Every attempt, check, finding and decision stays in the run record. |
| P-6 | Human authority | Where a Flow requires it, a person accepts or sends back. Automation never approves itself. |
One platformFour modules
Runs and governs the work
Flows of agent, script and human tasks: execution, isolation, checks, bounded rework, evidence and Human Review.
Plans and shows the work
The engineering workspace: epics and issues, boards and views. Every governed change shows its contract and acceptance criteria from Git, its pull requests and checks, and its HFC runs — each fact with its source and freshness. Lens never executes and never approves.
Already on Jira or Linear? Keep it. Lens is optional: HeptaFlow Control does not depend on it, and the contract can live in the tracker you use today. Connecting your tracker is part of the setup.
Generates the pipelines
Metadata-driven pipeline generation: describe sources, keys, history and rules once, and generate consistent, repeatable pipelines for Spark and Databricks instead of hand-coding every step.
Generates the test data
Test scenarios derived from metadata and SQL logic: structured source data for keys, history and lifecycle cases, generated for the legacy and the target engine alike — so equivalence covers more than the cases someone thought of.
What is real todayMaturity, stated plainly
| Capability | Status |
|---|---|
| Agent orchestration and controlled execution (Flows of agent, script and human tasks) | Implemented |
| Builder / reviewer separation across AI providers; bounded rework | Implemented |
| Retained evidence per attempt; Human Review accept / reject | Implemented |
| HeptaFlow Lens: work management with governed changes, Git / GitHub state and HFC runs (read-only) | Implemented |
| AI-driven epic delivery: epics in Lens broken into governed changes that HFC runs | Demonstrated |
| Governed legacy-ETL → Spark / Databricks migration with row-level equivalence | Implemented |
| A complete engineering change lifecycle as one automated Flow | Demonstrated |
| HeptaFlow Pipeline: metadata-driven pipeline generation | Coming |
| HeptaFlow Testdata: test scenarios and data derived from metadata and SQL logic | Coming |
| Reviewers tasked to disprove every claim (adversarial falsification) | Planned |
One control plane. Many processes.
In a typical AI application, a model completes a task. HeptaFlow runs a whole process: agents do the work, deterministic programs check it, people decide at defined boundaries, and HeptaFlow Control records every step. The domain logic and its tools change from one use case to the next. The control of execution, checks, decisions, evidence and approvals stays the same.
- 01 · Flow contractWhat must be achievedcriteria, checks and who decides — kept in HeptaFlow Lens, Jira, Linear or your repository
- 02 · WorkersAgents · Programs · Peoplereasoning and generation · tests and execution · approvals and interventions
- 03 · HeptaFlow ControlThe process control planelifecycle · routing · retries · isolation · evidence · audit trail
- 04 · Verified outcomeProof attachedpull request · data product · audit report · decision record · controlled change
- Demonstrated
AI-driven epic delivery
Plan an epic in HeptaFlow Lens. AI agents break it into governed changes, each with a contract and acceptance criteria. HeptaFlow Control runs every change through build, independent review and evidence; Lens shows the epic’s progress — and acceptance stays with people.
Planning in Jira or Linear instead of Lens works the same way: HeptaFlow Control runs the changes, whichever tracker holds the epic.epic in Lens → AI planning → governed changes with contracts → build → independent review → evidence → human acceptance
- Implemented
Legacy modernization & code migration
Translate legacy ETL to Spark and Databricks, and prove the result equivalent before anyone merges it. The same flow pattern extends to other legacy code.
analyze source → translate → independent review → run both engines → compare → pull request
See the reference case ↓ - Demonstrated
AI software engineering
Turn specified tickets into tested pull requests while quality criteria, approvals and every Git effect stay under control.
ticket → plan → builder → independent reviewer → test gates → bounded fix → human review → pull request
We build HeptaFlow itself under contracts, independent review and recorded human sign-off. The whole lifecycle has run as a single flow on specimen changes, up to the human decision. - Demonstrated
Data product delivery
Publish new data products with verifiable quality and a governed release.
data contract → pipeline → schema & quality checks → tests → approval where required → publication
Shown in the migration flow: generated pipeline, data-quality tests on both engines, a deterministic publication gate and a pull request. - Demonstrated
Data reconciliation & quality
Reconcile operational, warehouse and finance systems; investigate differences and verify every correction.
reconcile → detect differences → investigate cause → prepare fix → verify
Shown in the migration flow: complete target states and data-quality results compared row by row; an analyzer traces each difference to file and line; the fix is verified by a re-run. - Possible application
Compliance evidence
Collect and check evidence for technical controls, without handing final responsibility to an AI.
control catalogue → gather evidence → deterministic tests → analyze deviations → independent challenge → human review → audit report
- Possible application
Security remediation
Fix vulnerabilities across many applications with patches that are tested before they are proposed.
find affected components → patch → security & regression tests → pull request
- Possible application
Infrastructure changes
Plan infrastructure-as-code changes, check them against policy and verify the deployed state.
plan → policy checks → human approval → deploy → verify target state
- Possible application
Document-heavy decisions
Claims, contracts, tenders: structure the documents and prepare the decision. A person makes it.
intake → extract → rule & plausibility checks → independent review → human decision → documented outcome
- Your process
Work that has to be right?
If a process needs agents, checks and a person who signs off, it can run under HeptaFlow Control. Let’s map yours.
Discuss a pilot →
Reused in every use caseHeptaFlow Control
- Process control, lifecycle and routing
- Retries, bounded rework, stops and Human Review
- Isolation and operator permissions
- Evidence, checksums and an audit timeline
- Controlled artifact and repository actions
Defined per use caseWith you
- The domain flow and its decision points
- Agents, tools and system integrations
- Allowed correction loops and decision roles
- Security rules and access environment
- Domain checks, data contracts and target platforms
Not everything is turnkey. The control plane is reusable; domain adapters, contracts, test rules and approval policies are integrated and verified for each use case. A demonstrated pipeline is not production operation: rollout and industry-specific compliance are further steps.
Legacy ETL to Spark and Databricks — proven equivalent.
One agent translates a legacy ETL process into Spark SQL; a second, from another provider, reviews it. The original and the translation then both run on the same test data, and a program compares every row and every data-quality result. Only a proven-equivalent pipeline is published: a Databricks-ready bundle — notebook, Spark SQL load steps and data-quality tests — published as a pull request with a provenance record of how it was verified. Whether a deterministic gate or a person approves the merge is defined per Flow.
Honest limits. Demonstrated end to end on one pipeline so far. Equivalence is proven for the test data that ran; a case missing from the test data is not proven — which is why HeptaFlow Testdata is coming. Row-level equivalence is established on Spark against the legacy engine; on Databricks, the delivered job is verified by its run status, tests and row counts.
Built by engineers who sign off.
HeptaFlow is developed by STAG Consulting GmbH in Switzerland. It grew out of data-platform modernization work, where a fast answer is worthless unless someone can prove it is right. We build HeptaFlow under its own discipline: every change carries a contract, retained evidence and an explicit human decision.
See a governed run, end to end — from contract to decision.
A technical walkthrough for engineering leaders, data-platform architects and partners. Pilots and design partnerships on request.
Or write to office@stag-consulting.com.