Field notes: Why demo-grade workflow products fail in production

The demo trap

A polished agent canvas can hide the hard parts: who authorized the run, what policy applied, and how you prove it later. Buyers mistake UX polish for governance.

What production actually needs

HAIO (Human-AI Orchestration) treats three things as non-negotiable:

Scoped identity — org and agent DIDs, not anonymous API keys stapled to a prompt.
Delegation — install-time grants with presets (safe, autopilot, custom) and org policy that still wins.
Provenance — DAG nodes, structured receipts, and audit APIs — not screenshots of a chat.

Canon alignment: HumanOS-governed workflows (kb/163), not a parallel “workflow OS.”

Implementation evidence

Composed setups ship as humanos.bundle.v1 with ordered members (apps/api/src/services/install-bundle.ts).
Command Plane bundle install uses a read-only preview (POST /v1/control-plane/marketplace/install/preview) so operators see members and delegation templates before confirming.
Successful human.call responses include an action_receipt object (createActionReceipt in the invocation gateway).

A simple decision checklist

Before you call something “production-ready,” ask:

Can an auditor answer who delegated what to which agent without opening the vendor’s admin UI?
Is policy enforcement on the server, not only in the demo script?
Does every boundary crossing emit a receipt you can query programmatically?

If the answer is no, you still have a demo — just with better fonts.

Product & docs: Workflows · Governance · Building a bundle · Companion modules author experience