All-Access

A shoot day isn't recovered until it's recovered for everyone.

Comment

A shoot day isn't recovered until it's recovered for everyone.

All-Access turns every production disruption into a provably feasible, human-approved recovery plan that can never trade away an approved access arrangement — and proves the plan reached every department. No one gets left off the call sheet.

Inspiration

A film set changes all day. Weather closes an exterior, a performer is delayed, a generator fails, a location withdraws access at two hours' notice. Weather disruption alone is estimated to cost a production up to $500,000 a day, and 85% of productions hit scheduling problems. A first AD absorbs that by hand, on the phone, from memory.

The thing that gets dropped when a day goes sideways is never the camera. It is the arrangement that took three weeks to approve and exists for one person: the step-free route, the interpreter booked for every called minute, the refrigerated storage at base, the chaperone released at 17:30 to collect a dependant.

That is not a hypothetical. The industry has invented a job to hold it together — the production accessibility coordinator, whose published duties include adapting access plans "as necessary with changing production and accommodation needs." That is a person manually re-validating a set of approved arrangements against a schedule that keeps moving, under time pressure, often not in the room when the schedule changes, and frequently treated as a luxury line item.

Meanwhile the commercial reality is unforgiving in exactly the way software is good at: sign language interpreting agencies enforce 48-hour cancellation windows, bill the full block inside them, and charge rush premiums under five business days' notice. An 18:00 schedule change cannot extend a 09:00 interpreter booking, and no amount of goodwill changes that.

I wanted to build the system where losing one of those arrangements is structurally impossible rather than merely discouraged.

What it does

All-Access turns each disruption into a governed event and runs it through a closed loop:

  1. Ingest. The change arrives as a typed, schema-validated event on a Confluent-shaped backbone — 23 data contracts, 49 event types, hash-chained, idempotent, dead-lettered on malformed input.
  2. Scope. A bitemporal production digital twin — 208 entities, 699 relationships — computes the blast radius, scoped to the day being planned and ranked by how directly the disruption reaches each consequence.
  3. Assess. Fifteen expert agents run in parallel and return typed findings with evidence. An agent with no evidence returns ABSTAINED. No agent can decide feasibility.
  4. Plan. A deterministic engine — 34 constraints, 28 predicates — generates structurally diverse recovery plans, simulates each under uncertainty, and publishes nothing it cannot prove feasible. Plans it cannot build come back as a minimal conflict set: the smallest group of rules that cannot be satisfied together, each naming the document it came from and the person who owns it.
  5. Approve. The decision routes to whoever holds the authority. Approvals are HMAC-signed, single-use, expiring, and bound to both the plan hash and the constraint-set hash. Change either and the approval stops applying.
  6. Execute. Typed commands, saga-coordinated, to call sheets, transport dispatch, department queues and crew mobile.
  7. Reconcile. Intended state is compared against observed state. Nobody can call the day ready until they match. There is no override.

Thirteen views make all of it inspectable, including an infeasible-plan explorer — the view most systems do not have.

The gap this covers

Movie Magic Scheduling and StudioBinder are strong tools and this is not a replacement for either. They author and distribute a schedule. Neither decides whether a revised schedule is allowed.

Movie Magic StudioBinder Phone + spreadsheet All-Access
Breakdown, stripboard, scheduling ● ● ○ ○
Call sheet generation and distribution ◐ ● ◐ ●
Delivery tracking ○ ● ○ ●
Resource conflict detection ● ◐ ◐ ●
Cross-department consequence of a change ○ ○ ◐ ●
Feasibility proved before an option is offered ○ ○ ○ ●
Access arrangements as hard constraints ○ ○ ○ ●
Named reason when no option exists ○ ○ ◐ ●
Reconciliation of intended vs. observed state ○ ○ ○ ●

Four differences carry it:

Conflict detection is not feasibility. Movie Magic's red flags catch a double-booked actor. They warn; they do not stop a schedule being published, and they have no concept of a rule that may not be waived.

Distribution is not arrival. StudioBinder tracks whether a call sheet was delivered and confirmed — genuinely ahead of the field, and still about the document. All-Access reconciles the state it intended against the state downstream systems report, and blocks readiness on the difference.

Nobody else models an access arrangement as a constraint. In every incumbent tool an approved arrangement lives where special requirements live: a note. Notes do not participate in scheduling. When the schedule moves at 18:00, the note does not object.

"No" without a reason is not an answer. A conflict marker is not an explanation a location manager can act on.

Inclusion, as architecture rather than as a feature

This is why it is called All-Access — the phrase is the backstage pass and the promise at once: everyone who is called is on the set, and the system is built so a rushed plan cannot quietly revoke that.

The six approved access arrangements in the corpus — a step-free route, interpretation covering every called minute, captioned safety briefings, refrigerated storage at base, a quiet rest space, a caregiving release time — are hard constraints with no soft weight. The objective function is not permitted to trade one against a saved hour, because it has no coefficient with which to do so. A plan that drops one is not a worse plan. It is not a plan.

It fails closed, out loud. Take the hero storm and also remove the only step-free vehicle, and the system returns 0 feasible, 5 rejected — four citing "no step-free vehicle is available to satisfy ACC-001", and one citing the boatshed, which is free, obvious, and exactly what a conventional scheduler would offer:

Ormsvik boatshed has no step-free route from arrival to the working position and no surveyed step-free alternate position.

That is a sentence a location manager can act on. "Accessibility concern" is not. The spatial model works in millimetres and gradients — clear widths, threshold heights, surface, steps — so the refusal always carries the measurement that produced it.

It never records why anyone needs anything. There is no field in the schema for a diagnosis, a condition, or a category of impairment. This is a direct response to a documented failure mode: fear of disclosure suppresses the accommodation requests that get made at all, and performers have supplied their own accessible facilities rather than ask — Daryl Mitchell brought his own wheelchair-accessible trailer. A system that stores a reason creates a disclosure the person did not choose. The transport coordinator is told "step-free transport; accessible vehicle VEH-ACC-1 with powered lift" and nothing else, because dispatching a lift does not require knowing why. A redaction layer enforces audience clearance and per-arrangement visibility, and a tripwire counts any attempt to serialise a prohibited field. Across 52,775 events: zero.

Inclusion here is not a screen. It is a constraint class, a redaction boundary, and a refusal.

The numbers

1,000 disruptions, every figure recomputable from committed artifacts in bench/results/.
Hard-constraint violations in 1,629 published plans 0.000
Access preservation across 3,630 approved arrangements 1.000
Rejected plans carrying a minimal conflict set 1.000
Fabricated constraints across 18,420 findings 0.000
Prohibited personal fields across 52,775 events 0
Replay reproduces live state exactly · hash chain intact 1.000 · 1.000
Incomplete executions caught before closure 75 of 75
Disruptions ending in a named minimal conflict set 0.395

75 of 75 is the argument in one number. The harness creates executions where every command completes and a critical downstream step is still outstanding — a department that never accepted, an update that reached only part of its audience. Reconciliation caught every one. A system that closed the day on command acknowledgment would have declared all 75 ready: 12.4% of the 605 executions in the corpus.

0.395 is the product working. Those disruptions end with a named reason instead of a confident wrong answer.

What the pieces are worth

Same 200 scenarios, one capability removed at a time. Remove the independent feasibility recheck — which is what a plan authored by a language model or a spreadsheet actually is — and:

Full No independent validation
Hard violations per published plan 0.000 2.412
Access preserved 1.000 0.780
False closure 0.100 0.255
Named conflict set instead of a wrong answer 0.400 0.000

Every published plan breaks roughly two hard rules. 22% of approved plans silently drop an approved access arrangement. And the named-conflict-set rate goes to zero — it never fails closed, because it never checks.

How AI meaningfully improves the workflow

All-Access is an agentic system — a network of Gemini-powered specialist agents (on Vertex AI, through the Agent Development Kit) reasoning over a production digital twin, a deterministic feasibility engine, and a governed event backbone. Against the four things the IBM track asks a strong submission to show:

It improves a workflow. Recovering a disrupted shoot day is a manual job today — a first AD on the phone, from memory, re-checking a moving schedule against a set of approved arrangements. All-Access turns each disruption into a governed event and runs the whole loop — scope, assess, plan, prove, approve, execute, reconcile — in under a second, and shows its work at every step.

It enhances decision-making. Every recovery plan carries a feasibility proof, and every refusal carries a named minimal conflict set — the smallest group of rules that cannot be satisfied together, each naming the document it came from and the person who owns it. A call made under pressure becomes an auditable, explainable one: 0.395 of disruptions end with a reason a location manager can act on rather than a confident wrong answer.

It elevates the experience of the people it serves. The customer is the production and its crew, and the promise is that everyone who is called can work. Across 1,000 disruptions and 3,630 approved arrangements, access preservation is 1.000 — not one was ever traded away for a faster day.

It drives a measurable operational outcome. Weather disruption alone costs a production up to $500,000 a day. Reconciliation caught 75 of 75 incomplete executions before anyone could call the day ready — the 12.4% of runs a command-acknowledgment system would have closed early — and published 0 hard-constraint violations across 1,629 plans. Remove the independent feasibility recheck and every published plan breaks roughly two hard rules; the boundary is worth exactly that.

And the governance is the point: the language model reads, assesses and explains, but is structurally barred from the feasibility decision, which a deterministic engine owns. That separation is what makes an autonomous system trustworthy enough to run against a real shooting day.

How I built it

Google Cloud. Gemini (gemini-3.7-flash) via google-genai on Vertex AI is the reasoning plane for the fifteen expert agents. The hosted agent is a google.adk.agents.Agent with seven read-only function tools over the product's own read model (agents/adk_tools.py); the deployment refuses to run if the implemented tool surface and the approved allowlist ever disagree, and a denylist blocks approve_plan, issue_command, declare_ready and override_constraint explicitly. Deployment targets Vertex AI Agent Engine, Cloud Run, Artifact Registry and Secret Manager, with Terraform in infra/.

IBM Bob built part of the product. The engineering environment is committed: seven custom modes with scoped file permissions (.bob/custom_modes.yaml), engineering rules, and two working MCP servers — one exposing the schema registry with a real compatibility check, one exposing the committed benchmark artifacts and a live pytest run, so a session asked for a performance claim reads the number instead of inventing one. In one recorded session (bob-evidence/, video linked below), Bob — in Connector Modernization mode, given only the legacy adapter and a brief and told not to open the reference — rebuilt the call-sheet connector from scratch: a typed, idempotent, event-driven callsheet_bob.py that resolves all eight documented defects, each with a failing-first test (16 tests, all green; full suite 249). It reached the same load-bearing design as the independently hand-written reference — a Pydantic schema that forbids unknown fields, per-instance state, content-hash idempotency, a redaction layer that logs counts not identities — without seeing it. That is AI modernizing a legacy integration under a governed, reviewable process.

Confluent is the event backbone: ConfluentEventBus and ConfluentSchemaRegistry register 23 subjects, validate every payload before append, enforce BACKWARD compatibility and dead-letter failures. It is built for Confluent Cloud — the schema-registry client speaks the Confluent Schema Registry REST API, and its compatibility enforcement is unit-tested (an added optional field is accepted; a new required field or a narrowed type is rejected). Moving from the hosted demo to a live cluster is a single environment switch — AA_STREAM_MODE=confluent plus the cluster credentials — with no code change; the deployment ships with a byte-compatible local drop-in bus so judges can run the entire event-driven loop with no credentials at all.

Letting a language model into a production decision system

The model plane is allowed to write, and then its writing is checked by deterministic code.

agents/core.py::ungrounded_claims reads every response for identifiers (C-ACC-002, LOC-BOATSHED) and quantities (45 mm, 18:30, 68 kph) that do not appear in the facts the model was given. A response carrying an invented constraint id or an invented threshold is discarded in favour of the deterministic text, and the rejection is recorded and shown in the product.

It cannot establish that the prose is true — no regular expression can. It establishes that every checkable token came from the input, which is exactly the class of detail a fluent paragraph carries convincingly and a reader cannot verify. That is a control that does not ask the model to behave; it checks whether it did.

The load-bearing boundary sits between the two planes. engine.publish takes its verdict from engine.validate, which runs constraints.registry.evaluate, which runs 28 predicates. No model output reaches it. That is the call graph, not a policy — and the ablation table above is what it is worth.

Built With

Share this project:

Updates