The LLM only extracts facts and drafts replies. A pure policy engine decides what is allowed, the workflow executes it, and a human approves anything risky. An approval is bound to the exact proposal, so it is void if the proposal changes.
llm.extract (structured facts) → policy_engine (pure functions over policy.json) → mock tools → llm.draft. LLM calls are recorded and replayed, so this page is free and deterministic. All orders, buyers and amounts are synthetic.