Built as a system.Not a wrapper.
Under every agent sits a decision engine with its own memory, its own compiled compute library, a columnar data plane, and routing that picks the right model for every step — on an execution layer that cannot drop a job once it has started.
Corin's execution layer is the same class of durable-execution backbone that runs Codex-scale AI workloads and bank payments modernization — proven infrastructure, not something we invented last quarter.
AI agent architecture for ERP: one request path, top to bottom.
The engine decides, the agent graph reasons, durable execution carries the work, routing picks the model, memory remembers — and only a connector touches your ERP.
The engine under Corin.
Corin runs on its own decision engine — a full stack under the agents, not a thin wrapper on a model. What it does, in plain words:
- Ranked options, risk attached
- Corin doesn't take the first answer. The engine lays out the options, scores each one against your rules, and keeps the losers on file — every recommendation arrives with its runners-up, the reason they lost, a best case, a worst case, and the odds of losing money.
- The dry run, seeded
- Every change gets a dry run first: see what Corin will do before it does it. Each run is seeded, so running it again gives the same outcome — a rehearsal you can repeat, not a screenshot.
- Replay, with proof
- Every run checkpoints as it goes, and every checkpoint carries a fingerprint. Replay a decision next quarter and the engine reports whether it matched — step by step, hash by hash.
- Decision memory
- Every decision is kept with its outcome: what the engine saw, what it chose, what it rejected — and when the result differs from the forecast, that gap is measured, not forgotten.
- Versioned policy, receipts
- Every rule change is versioned. Every action names the exact version of the rules that approved it, and executing a decision returns a receipt bound to that version.
- Capability records
- No tool may execute without a capability record. Every callable action carries its risk class, its policy requirement, and whether it needs an approval — before Corin can even consider it.
- Connections, tested first
- Your systems don't move — Corin connects to them where they are, tests the connection before it trusts it, and reads live state at decision time. A connector that fails its health check is quarantined, not quietly wrong.
- Computed, not guessed
- Under every decision sits a compiled library of math and operations functions — forecasting, credit risk, pricing, scheduling — so a quote is computed, not guessed.
- A columnar data plane
- Working data lives in a compressed columnar store — the format the analytics world standardized on — so grounding a decision scans millions of rows in memory instead of querying the ERP one record at a time.
- Built for volume
- Answers stream token by token. The working memory that serves them is paged, so one long job cannot starve the rest, and requests batch continuously instead of waiting in line — the engine's speed limits are part of its contract, not a hope.
What we name, and what it may do.
Every part is bounded on purpose — the reasoning runtime and the execution backbone each do one job. The routing and the memory are Corin's own.
Agent graph — reasoning, nothing more
Corin keeps the agent-graph runtime bounded to reasoning: the model reads, drafts, and proposes. It cannot write to an ERP, send a message, or post an invoice — proposals go to policy, not to the world.
Durable execution — work that never gets dropped
If SAP times out at step 7, Corin resumes at step 7 — not step 1. Signals, timers, and retries live in the execution layer, so a crash or restart loses nothing.
Model routing — the right model for every step
Fast ones to read, strong ones to decide. Every step is metered — model, cost, latency — so the expensive model only runs where it earns its keep. Which providers Corin may use is your call, not ours; a provider outage is Corin's problem, not yours. Point it at endpoints you own — Azure OpenAI, Amazon Bedrock, Google Vertex AI, or a model inside your walls, including Azure Government and AWS GovCloud — and locked to private mode it fails closed, never quietly detouring to a public API.
Memory — scoped and inspectable
Corin's work graph — one live view of every job — keeps the case history; the engine's decision memory keeps the why: what it saw, chose, rejected, and what happened next. Scoped to your tenant. Expirable. Auditable. Off until you turn it on.
Four verbs, no shortcuts.
Every consequential action walks the same path. In engineering terms: a model proposes, policy authorizes, the durable-execution layer drives the connector that commits, and the ledger proves — a record of every decision: what changed, who approved it, when.
No agent or LLM node ever writes to an ERP, sends a customer message, posts an invoice, approves a customer, or submits a claim directly.
The same command can never post twice.
Connections drop mid-write; Corin plans for it. Every consequential command carries a full identity envelope, so a retried or ambiguous execution lands once in effect — and can prove it.
tenant_id: t_8f3… business_case_id: bc_Q-2308 transaction_id: txn_01J9… action_id: act_quote_commit_03 business_idempotency_key: C10042:quote:Q-2308:v3 side_effect_fingerprint: sha256:9d2c… expected_erp_version: m3.so.head.rev118 connector_version: m3-connector 1.14.2 policy_decision_id: pol_77e1… approval_id: apr_m.chen_2026-08-29 dry_run_hash: sim_4bd0…
Every action carries a class.
- read-only
- No external effect — reads through released, permissioned APIs.
- reversible
- Undone by a second action, inside the same policy envelope.
- reversible-with-approval
- Undo requires a person's confirmation first.
- irreversible
- Cannot be undone — always gated on a person, always signed.
- requires-compensating-transaction
- Undone only by an explicit compensating action, walked in order and ledgered.
Ambiguous timeout → query by the business idempotency key, never blind-retry.
Four deployables, four delivery forms.
corin-api
Configuration, cases, approvals, REST, webhooks, the UI, authentication and authorization.
corin-worker
durable-execution workers, module workflows, bounded agent-graph reasoning, extraction, policy enforcement, audit and metering.
corin-connector
Hosted or customer-local, outbound-only: ERP adapters, Microsoft Graph, secrets, the dry run / commit / read-back.
corin-control
Licensing, entitlements, the deployment registry, signed releases, health telemetry.
01Hosted
Corin runs everything; you connect.
02Private connector
The connector runs customer-local and outbound-only — no inbound ports, no VPN.
03BYOC
The platform runs in your cloud; the control plane sees licensing and health metadata only.
04Air gap
Fully isolated, for qualified deployments.
Regulated tenants bring their own inference: Azure OpenAI, Amazon Bedrock, or Google Vertex AI endpoints in your own tenancy — including Azure Government and AWS GovCloud — or self-hosted models inside the air gap. Your keys, your invoice, your boundary.