BounedOps

• 

  BoundedOps: a Qwen-powered agent society where production authority is negotiated before action.

• 

  Incident dashboard with the canonical benchmark: Society 0.87 vs baseline 0.75 across 12 cases.

• 

  Checkout incident detail page where operators can launch a Society or baseline response run.

• 

  Live Society run in progress: agents investigate under an active ARCL contract.

• 

  ARCL negotiation transcript showing a granted tool amendment and enforced authority limits.

• 

  Agent society trace: brokered tools, blocked actions, disagreement, and Judge resolution.

• 

  Evidence tab showing logs, code changes, and runbook evidence collected through the Tool Broker.

• 

  Completed Society run with verdict, safe action, approval gate, and rollout controls

• 

  Judge verdict identifies the N+1 root cause and requires human approval before production change.

• 

  Human approval recorded by the operator, unlocking staged sandbox rollout.

• 

  Sandbox rollout passed after approval; production deployment remains gated.

• 

  Evaluation harness proving the governed Society beats the single-agent baseline

Inspiration

Incident response is not just a reasoning problem. It is a control problem.

A powerful agent can read logs, inspect metrics, find a root cause, and still recommend the wrong production action. In real operations, the dangerous part is not diagnosis alone. It is deciding who has authority to use tools, spend budget, change systems, or recommend remediation during an incident.

BoundedOps was built around that idea: agents should not act freely just because they can reason. They should negotiate authority first.

What BoundedOps does

BoundedOps is a Qwen-powered multi-agent incident response system where agents must negotiate an ARCL contract before using tools, spending budget, or recommending production actions.

ARCL stands for a resource and authority contract. It defines:

• which tools each role can use
• which actions are blocked
• how much budget each agent can spend
• which recommendations require human approval
• what constraints must be enforced during the incident

The system includes six role-scoped agents that divide the investigation, gather evidence, disagree, negotiate contract amendments, and produce a final verdict. Agents never call tools directly. Every tool request goes through the Tool Broker, which enforces the active contract, budget ledger, and safety policy.

If an agent needs more authority, it must negotiate. A Negotiator proposes an amendment, an Arbiter grants or denies it, and the amended contract is persisted and enforced. Unsafe production actions, such as an unauthorized rollback, are blocked and logged.

How we built it

BoundedOps has a FastAPI backend, a Next.js frontend, and a full evaluation harness.

The backend contains the ARCL contract engine, multi-agent orchestration, Qwen Cloud integration through DashScope, the Tool Broker, negotiation flow, evidence store, judge, and human-approval gate. The frontend shows the live incident run: contract state, agent society trace, negotiation transcript, tool evidence, conflicts, and final verdict.

The evaluation harness compares the governed society against a single-agent baseline across 12 incidents. With Qwen reasoning and negotiation enabled, the society scored 0.87 versus 0.75 for the baseline. Both systems found the root cause 12/12 times, but the society produced sound safe actions 8/12 times versus 3/12 for the baseline, and resolved 6 disagreements versus 0 for the baseline.

What we learned

The biggest lesson was that multi-agent systems are most useful when their disagreement becomes part of the product, not hidden internal chatter.

The single-agent baseline often found the root cause but froze before recommending a concrete safe fix. The agent society spent more tool budget, but it surfaced conflicting hypotheses, forced negotiation around authority, and produced better governed remediation decisions.

We also learned that safety boundaries work best when they are runtime-enforced. Prompt instructions are not enough. BoundedOps treats agents as untrusted workers and makes the runtime responsible for contracts, budgets, tool access, and approval gates.

Challenges

The hardest part was making negotiation real instead of cosmetic. The contract had to change at runtime, the arbiter needed both model judgment and deterministic safety floors, and every tool call had to prove it was allowed under the active contract.

Another challenge was keeping the benchmark honest. We kept the single-agent baseline, the society harness, and the scoring outputs in the repo so the improvement is measurable rather than claimed.

The final challenge was building a demo that makes the control path visible: incident, contract, agents, negotiation, Tool Broker enforcement, disagreement resolution, and human approval.

What's next

The Tool Broker is designed so real integrations like Datadog, GitHub, Slack, Jira, or cloud remediation APIs can be added behind the same contract enforcement layer. The goal is not to give agents more unchecked power. The goal is to make production agent systems safer by making authority explicit, negotiated, and enforceable.

Built With

• alibaba
• broker
• cloud
• contract
• css
• enforcement
• evaluation
• fastapi
• harness
• human-in-the-loop
• multi-agent
• next.js
• python
• qwen
• react
• sqlite
• sre
• tailwind
• tool
• typescript