Joy

How JoyPilot works, end to end

One utterance in, one governed, audited DBS payment out. A model may propose; only deterministic code may decide.

Reading this against the control chain

The diagram above numbers its boxes 0–16. The sixteen-stage control chain on the main screen is the same walk with the same names, numbered 0–15, and the two agree exactly on 0–8. After that:

• Box 8 covers two stages. The diagram draws the Validation Agent and its “checks against original words” as one box; the chain runs the agent (stage 8) and the deterministic comparator (stage 9) separately, because one is a model and one is code.
• The Banking Policy Check is one stage, not four. The dashed block holds boxes 9–12. The chain runs the policy, risk and velocity checks as one stage (index 10), because they read the same resolved draft and share one decision. It runs the field-by-field confirmation as its own stage (index 11).
• So from chain index 11 on, the chain index is the diagram number minus one. Nothing is missing and nothing is duplicated; the two are the same path at two different resolutions. The Execution-path page shows it stage by stage.

One sentence in, one checked and audited payment out

AI proposes. Deterministic code decides. Auntie approves. Tencent Cloud carries the voice. No model ever holds a key or touches the ledger.

The five agents

Four agents sit in the payment control chain. The fifth, the Personalization Agent, runs next to it and only changes how Joy asks. Each agent makes one decision and returns typed JSON. None of them holds a signing key, a gateway credential or ledger access.

What keeps the agents in check

• A model's output is data, never an instruction. Every agent returns JSON that is parsed against a strict schema. Anything out of shape is rejected and the turn falls back, so it can never be read as a command.
• The Validation Agent works on its own. At stage 8 it never sees the other agents' reasoning. It reads the saved evidence and the draft, checks each field, and returns PASS or FREEZE. Stage 9 is plain code that checks that answer again.
• If a model fails, the rules take over. If an agent times out or returns something malformed, its deterministic mock answers instead. The answer can get plainer, never less safe.
• Words cannot move money. No prompt, in any language, can produce a signature, an approval or a ledger write, because those live in code the models cannot call.

The sixteen-stage control chain, in order

Stages 3, 4, 5 and 8 are the only stages in the chain that call a model. Everything else is code, and there is code before and after each model stage. The AI stages can only propose; the code stages decide.

What is simulated and what is real

Two things in this build are mocks, and both are named on the screen. Everything either side of them is the live system.

Requirements coverage 5 OF 5 DEMONSTRATED

The challenge's five criteria, in its own wording, mapped to the scenario and stage that demonstrate each one. Rows light up as their scenario runs, so this is live evidence about the turn on screen.

The execution path: from voice to a signed payment

Every stage from 09 onwards is deterministic code, and only stage 15 can record a payment.

The signed artifact is produced at stage 13. The gateway at stage 14 rebuilds it and does not trust anything it is told. The mock ledger at stage 15 is the only place a payment is recorded.