israel.rocklyn

CI green on 48/49 repos

AI & LLM · desk.agentsCI passing

Enterprise Multi-Agent Workforce

A service desk staffed by scoped AI agents that can do for you only what you could do yourself.

Open the live demo View the code Evaluation report Demo tour Run it ›_ last push 3 days ago

0 / 310hostile tickets that caused an unauthorized effect (one service-account agent: 211)

78.8%of legitimate tickets correct on fresh wording (keyword router: 56.1%)

0.85 vs 51colleagues a hijacked HR agent can affect, acting for the requester vs as a service account

Evaluation report: legitimate tickets handled and hostile tickets blocked by five designs, attacks and blast radius
Evaluation report: legitimate tickets handled and hostile tickets blocked by five designs, attacks and blast radius. Screenshot from the project's demo (synthetic data).

demo Demo tour

Screenshots from the running application, with its synthetic demo data. Select one to enlarge.

Legitimate tickets handled and hostile tickets blocked, for five designs on three phrasing banks.
Legitimate tickets handled and hostile tickets blocked, for five designs on three phrasing banks.
The service desk: each ticket, the agents that handled it, and what the systems allowed.
The service desk: each ticket, the agents that handled it, and what the systems allowed.
Attacks by type, results by ticket type, and the blast radius of one hijacked agent.
Attacks by type, results by ticket type, and the blast radius of one hijacked agent.

01 The problem

Agents wired to company systems through one powerful service account become confused deputies: a ticket that asks for a colleague's payslip, or hides an instruction to reset someone else's password, only has to convince the model.

02 How it works

  1. Ticket (requester from SSO)
  2. Triage splits and routes
  3. Scoped specialist agent
  4. Systems: scope + requester's rights + approver
  5. Effect or refusal
  6. Reply to the requester

03 What I built

  • A triage agent that splits tickets into requests and routes each to IT, HR, Finance, Facilities or Security specialists, each holding only its department's tools; Claude (one conversation per agent) or an offline classifier.
  • Company systems where every call carries the authenticated requester: an action needs the agent's scope, the requester's own rights and, for some actions, a named approver. Identity is never a tool argument.
  • An evaluation of five designs on the same tickets in three phrasing banks (the last written after the model was frozen), hostile tickets judged on effects, and a blast-radius test with one agent fully hijacked.

04 What I learned

The comparison showed the safety comes from acting on behalf of the requester, not from having several agents: one agent with every tool is just as safe when it acts for the requester. Splitting into scoped agents earns its place by containing a hijacked agent.

A third phrasing bank, written only after the model was frozen, gave the honest score (78.8%) instead of the dev score (100%).

05 Known limitations

Every repository documents what it doesn't do yet. The main ones:

  • Generated tickets and simulated approvers; the systems are in-memory models, not Workday or Entra ID connectors.
  • The offline agents ask for clarification on about a quarter of fresh-wording tickets; the Claude agents are not scored in CI.

06 Stack

PythonClaude APIscikit-learnFastAPIDocker

The repository has the design document, operations runbook, full evaluation report and known limitations. All data is synthetic, generated by code in the repository.

run Run it yourself

Every project runs on a laptop: no cloud account and no paid API needed.

git clone https://github.com/codeROCK-IZZY/enterprise-multi-agent-workforce.git
cd enterprise-multi-agent-workforce
pip install -e ".[dev]" && pytest
workforce evaluate --gate                   # writes eval/reports/report.html

↑↓ to move · Enter to open · Esc to close