Appendix · for Ben

Auth & data boundaries

• Copper API key + a system-user token for Meta — secrets in environment only, never in git
• PII lives in Copper and local gitignored stores; it does not leave the machine
• The model sees the agent's call note and that lead's working context — nothing more
• Nothing trains on any of it
• Operator notifications carry names and counts, never lead contact data
• Practice leads use fabricated contacts

Appendix · for Ben

Write paths

• Every Copper mutation goes through one typed client — no scattered write code
• Every agent action passes a fail-closed policy engine before it executes
• Outward actions — contact, SMS, email, spend — require an approval token plus a consent record
• Verified in live testing: the AI proposed an outreach and its own policy engine refused it
• Denied surfaces don't exist in the client at all: billing, payment methods, custom audiences, ad-account settings

Appendix · for Ben

Approval gates & autonomy

• Operator-signed go-live registry — nothing ships without a signature on record
• Operator-only write flag, plus a killswitch file that halts everything
• Spend caps enforced in code, aggregated across campaigns and ad sets so they can't be double-booked around
• Inline compliance pre-screen on all copy — BLOCK rejects, FLAG routes to the audit log
• Append-only audit chain on every action taken

Appendix · for Ben

Failure handling

• Idempotent event dedup keyed on activity id; an in-flight claim set prevents double-processing
• Monotonic watermarks — a slow poll can't drag the window backward
• Rate limiter at 180/min with backoff
• Fail-closed jurisdiction: unknown ownership means act on nothing
• Errors are logged and retried, never crash-looped
• 117 automated tests · adversarial self-review found 4 silent failures, all 4 fixed

Appendix · for Ben

36 seconds, measured

Agent saves the note → summary written, stage moved, appointment task created.

• 10-second poll heartbeat — our share of the latency
• Copper's own search-index lag: measured 30s–5min, variable, outside our control
• Copper has no activity webhooks — type=activity is rejected by the API, so push isn't available to us
• Native would make this instant.

Appendix · for Ben

At 200 agents

• Poll cost is per-tick constant, not per-agent — a cached scope list plus one dated activity search
• So agent count does not drive API load
• The model work scales with calls logged, not seats
• The 180/min ceiling is the real headroom limit — and where it runs out is a known, measurable number
• Honest: 18,000-seat unit economics is exactly what the scoping session should size, with your team

Appendix · for Ben

Architecture — Copper stays the system of record

Appendix · for Ben

Trigger and write path — source, rule, record

• The agent's call activity is the source event — every write traces back to a human action
• Penny reads only the context required for that workflow — bounded, not the whole account
• Defined actions pass through policy and write gates before they execute
• Copper stores the result and the operator-visible evidence
• No source event, no write. No rule match, no write. Every write leaves a record

Appendix · for Ben

Scale path — throughput, not authority

• Partition work — independent queues by workflow
• Observe latency — trace each source event through to its outcome
• Keep gates fixed — more volume never broadens permission
• Poll cost is per-tick constant, so agent count doesn't drive API load
• Model work scales with calls logged, not seats