← Work · Case 02
In developmentAgentic workflows · MCP server

AI Control Tower: delegation behind a gate

Premium agents keep the reasoning. Bulk work goes to cheaper models, only after an exact approval.

StatusIn development
TypeMCP server
RoleConcept, design and build, with AI agents

01 · Problem

Problem

Large documents and datasets burn expensive agent tokens on work a cheaper model can do. Handing jobs to other providers usually means silent fallbacks, exposed keys and no record of what ran where.

02 · Approach

Approach

An MCP server with six tools. The agent plans a job; the tower answers with provider, pinned model, privacy class, limits, an informational estimate and the reason for the routing, plus an exact approval phrase. Nothing runs until a human types it.

03 · Architecture

Architecture

agent request/ local filesSOURCEplan jobSTEP 01lock providerSTEP 02pin modelSTEP 03exact approvalHUMAN GATEjob ledgerOUTPUTSOURCE → PROPOSAL │ HUMAN GATE │ INSPECTABLE OUTPUTagent request / local filesSOURCEplan jobSTEP 01lock providerSTEP 02pin modelSTEP 03exact approvalHUMAN GATEjob ledgerOUTPUT
Sanitized architecture · roles and decisions, never real data.

04 · Guarantees

Guarantees

  1. 01No live call is made while planning.
  2. 02The named provider is locked. An error never triggers a fallback.
  3. 03Keys stay in the OS keychain, never in the chat.
  4. 04A file changed after planning needs a new plan and a new approval.
  5. 05Partial, failed or cancelled jobs are never presented as complete.

05 · Stack & decisions

Stack & decisions

TypeScriptStrict contracts between the agent, the tools and each provider.
MCPAny coding agent can use the six tools without custom glue.
Gemini · DeepSeek · Groq · GrokAdapters behind one provider-neutral contract, each with contract tests.
OS keychainKeys are read at call time and never pass through a prompt.
Job ledgerEvery job is recorded locally and can resume from its checkpoints.

06 · Proof

Proof

AI Control Tower · the six toolsinterface · authentic, sanitized
  1. ai_provider_statuschecks locally that credentials exist; never shows keys
  2. ai_plan_jobnon-executing plan: provider and model pinned, finite limits,
  3. and an exact approval phrase
  4. ai_submit_jobruns only if the phrase matches exactly
  5. ai_job_statusreads local state
  6. ai_get_resultnormalised results with provenance; partial is not complete
  7. ai_cancel_jobstops future work, keeps what was already created
  8. privacy classes
  9. publicexplicit or automatic routing
  10. privateonly after the provider data policy is assessed for that job
  11. sensitiveprovider must be named; stop if retention or region is unknown
  12. a cost estimate of "unknown" means unverified. never free.

Excerpt from the real system, translated and sanitized: no names, identifiers or data.

Next case · 03Search monitoring that diagnoses before it alerts