Food & Beverage AI agent · Food defence
Food Defence Plan AI Agent
Marshal the vulnerability assessment behind each actionable process step under § 121.130, run the § 121.157 reanalysis clock, and hold the plan for the owner, operator or agent in charge who signs it.
- Typical delivery
- 4–6 weeks
- Deployment
- Your stack
- Named officer
- Two signings
- After launch
- Agent Care
What this agent does
Assembles the evidence, never the signature
In
- 01
A step is assessed, and § 121.130 wants the inside attacker weighed, not the stranger alone.
- 02
A step turns actionable, and § 121.135 wants a written explanation of how a strategy prevents it.
Reason
- 03
A strategy is monitored, and § 121.140 wants the written procedure and its frequency on file.
- 04
A strategy fails, and § 121.145 wants the problem corrected and recurrence made less likely.
- 05
A record is verified, and § 121.150 wants monitoring and corrective-action entries read in time.
Decide
- 06
A plan is reanalysed, and § 121.157 sets the three-year interval plus four forced triggers.
- 07
A change is planned, and § 121.157 wants reanalysis before it is operative, or inside ninety days.
Out
- 08
A plan is modified, and § 121.310 brings the owner, operator or agent in charge back to sign.
- 09
Execute write actions only inside the approval boundaries agreed during implementation.
Product statement
The agent assembles evidence and tracks the reanalysis clocks. The owner, operator or agent in charge signs and dates the written plan under § 121.310.
Example workflow
One process step, evidence to signature
- 1Step evidence receivedProcess maps, access records, monitoring entries or corrective-action logs
- 2Step context assembledThe step, its public-health impact, the physical access it allows and the strategy on it
- 3Assessment evidence draftedThe steps assessed, the explanations written, the gaps and completeness
- 4Controls appliedReanalysis-clock checks, strategy-coverage checks, record-currency checks and completeness confidence
No human action required
Stages 1 to 4 run unaided, and nothing is signed at any of them — the agent is assembling, and the defence lane opens at the completeness gate.
Goes to the owner, operator or agent in charge to sign.
Adds a food defence read first.
Food defence review
The plan is held with its steps, its strategies and the explanations behind them.
Sign · Append evidence · Send to food defence review
Signed and dated — under § 121.310
- 6Plan and training records updatedOnly where write access and records policy allow it
- 7Outcome evaluatedStrategy coverage, reanalysis timing, reviewer corrections and what the read found
Corrections
Each food defence correction is counted in the evaluation.
What should not run autonomously
Human approval stays in control
Outside the boundary — human approval required
8 items
- Signing and dating the plan under § 121.310.
- Preparing the food defence plan under § 121.126.
- Conducting the vulnerability assessment, § 121.130.
- Identifying mitigation strategies under § 121.135.
Automation boundary
Agent acts unaided
- ✓Assemble the evidence behind every actionable step.
- ✓Track the three-year clock and its forced triggers.
- ✓Chase the written explanation a mitigation strategy still lacks.
- ✓Flag the process step whose strategy coverage cannot be shown.
Nothing is signed or reanalysed except by a named person, inside agreed boundaries.
- Reanalysing the plan as a whole under § 121.157.
- Concluding that no revision to the plan is needed.
- Writing the justification for a longer timeframe.
- Changes to plan, training or monitoring records.
Example output
One process step, annotated
Staggered compliance closed on 26 July 2019, 27 July 2020 and 26 July 2021; this record is what one actionable process step carried afterwards.
Plan evidence · single process step
Illustrative example- Process step
- Bulk liquid receiving, § 121.130
- Recorded as
- Assessed actionable, inside attacker weighed
- Step class
- Actionable step
- Evidence of record
- Vulnerability assessment, 3 August 2026
- Confidence
- Held unsigned
- Held for
- The owner, operator or agent in charge
As received
Taken from the plant's own process maps and access records — it reaches as far as those sources do.
What the record holds
- Access record
- Strategy explanation
- Monitoring entry
Why no signature here
Whether the plan may be signed is a § 121.310 act reserved to a person.
What the score decides
Below the configured threshold the plan picks up a defence read before the signer sees it.
Action
SignAppend evidenceSend to food defence reviewValue
Where AI adds value
The same four claims, placed at the point in the workflow where each one applies.
Where the value lands
Value 01 – 04
Every process step
From the map that names it
Where the evidence is used
Our QA and HACCP assistant works the same facility, the same signer phrase and the same plan, monitor, verify and reanalyse skeleton on a different threat model — Part 121 is the inside attacker at an actionable process step, not a food-safety hazard.
Two signings, one plan
§ 121.310 fires on initial completion and on any modification, and § 121.301 holds that signature to the written plan alone.
What was checked, and not found
Food defense qualified individual could not be verified as codified CFR text, and § 121.3 was not retrieved verbatim; the operative construct is the qualified individual plus § 121.4(c) training at least equivalent to an FDA-recognised curriculum, with § 121.4(b) awareness training and § 121.4(e) records.
Build an evidence trail
The step, the strategy guarding it and the officer who dated the plan stay together.
Integrations
Typical integrations
Five system groups connect to the same agent. Which of them are in scope is decided in discovery.
Process maps and plant access
- Site layout
- badge logs
- Actionable process steps
Monitoring and corrective actions
- Quality systems
- e-forms
- Deviation and correction logs
Training and personnel
- LMS
- HR records
- § 121.4(e) training records
Agent
Food defence plan evidence
- Reads the steps
- Assembles the evidence
- Holds for the signer
Verification and records review
- Records review
- audits
- Reanalysis triggers and dates
Observability & evaluation
- OpenTelemetry
- Langfuse
- Supported monitoring/evaluation sources
Integration availability depends on the client's existing systems and API access.
Agent controls
Six screens between the model and the signature
Six screens, and the last of them is the tightest. What still gets through is drawn in the map below.
L6 · Outermost — last line of defence
Inward → L1 · closest to the model
- L1 – L2
- Test whether a plan may stand
- L3
- Puts the signature in a person's hands
- L4 – L5
- Keep the step and the strategy behind it
- L6
- Holds the plan unsigned when signals degrade
How Nestack evaluates it
Evaluate the whole assembly — not only the plan evidence that comes out.
Coverage runs the whole depth of the workflow, and every layer is cut by slice.
Surface — the plan an inspector reads
- E1Final-output evaluationDid the evidence record what each process step actually carried?
- E2Step-level evaluationDid the agent read the right step, the right strategy and the plan version in force?
- E3Tool evaluationDid it read and write the correct step record and the correct strategy?
- E4Confidence calibrationDo low-confidence evidence sets actually attract more defence corrections?
- E5Slice evaluationHow does performance change across specific process steps?
- E6Business outcomeHow many sets needed a correction before the officer signed?
Floor — the plan the facility answers for
Failure modes
Where each failure originates in the agent
Seven failure modes, each set at the stage where it first surfaces.
Agent lifecycle
Direction of processing →
01 · Retrieval
1 mode
- JM-03
Stale process map read
The layout read is not the one now on the floor.
Stage gathers
The steps, the strategy, the record and the date
02 · Reasoning
2 modes
- JM-04
Step asserted, not shown
A step is called covered without its explanation.
- JM-06
Draft guidance read as final
The draft instalments are worked as binding.
Stage proposes
The steps, their strategies and completeness
03 · Tool / write
2 modes
- JM-02
Thin set passed forward
A set moves on without the defence read.
- JM-05
Evidence bound to wrong step
A record is filed against the wrong step.
Stage writes
Only where write access and approval policy allow it
04 · Output
1 mode
- JM-01
Signed, evidence unrecorded
The plan shows a signature but not what supported it.
Stage returns
The plan an officer signs and an inspector reads
05 · Change / Version
1 mode
- JM-07
Silent trigger regression
A configuration change moves the trigger, not the plan.
Stage tracks
Model, prompt, plan rules and evidence fields
- Sev-1 · a plan signed on no evidence
- Sev-2 · wrong evidence reaches the plan
- Sev-3 · source degrades, plan holds unsigned
Affected slices
Bulk liquid receiving absorbs the corrections
A step-level mitigation-coverage figure can read clean while bulk liquid receiving carries most of the rework. Nestack reports the correction rate by process step, not only in total.
Slice performance — reported separately, not only in aggregate
Illustrative example| Slice | Failure rate | Lift | Lift vs. threshold | Status |
|---|---|---|---|---|
| Bulk liquid receiving and holding | 10.6% | 3.7× | Review | |
| Steps worked by temporary personnel | 7.5% | 2.6× | Review | |
| Secondary ingredient handling | 4.7% | 1.6× | Watch | |
| Steps under continuous supervision | 2.2% | 0.8× | Normal |
Bar: correction-rate lift vs. supervised-step baseline · scale 0–4.0× · tick marks the 2.0× review threshold
2 of 4 slices over threshold
Evidence-linked improvement
What an unreanalysed change costs
A cycle shuts when the unreanalysed change is a regression case. That suite is what the next plan assembled is measured against.
Improvement cycle · five stages
Switchback — the path turns at Improve and returns at Learn
- 01
Detect
Correction rate rises on bulk liquid receiving.
- 02
Diagnose
The step where a stranger could reach the batch, and the plan that never named it, are read back until one cause remains.
- 03
Improve
The change ships numbered, and the steps that forced it ride with it.
- 04
Verify
Nothing releases while one touched step case is still red.
- 05
Learn
It is retained for good, and the plan rules are amended in that same commit.
Learn → Detect
The return edge. The next plan is measured against a suite one case longer.
Typical build scope
Twelve workstreams across six weeks
The build scope read against the delivery timeline. Week structure follows the six-week plan — discovery, sources, evidence assembly, evaluation, integration, then production validation and handover.
Workstream
Week 1Week 2Week 3Week 4Week 5Week 6
- 01Process-step discovery and automation-boundary work.Week 1
- 02Access, monitoring and training sources.Week 1, Week 2
- 03Step-to-strategy and reanalysis-trigger mapping.Week 1, Week 2
- 04Step and strategy evidence ingestion.Week 2
- 05Step, strategy and record binding.Week 2, Week 3
- 06Completeness scoring and review routing.Week 3
- 07Owner and operator signing workflow.Week 3, Week 4
- 08Training and quality-system integration.Week 5
- 09Vulnerability and reanalysis cases.Week 4, Week 5
- 10Guardrails and signing controls.Week 4
- 11Plan-trail instrumentation.Week 5, Week 6
- 12Deployment, documentation and Agent Care handover.Week 6
12 workstreams · 6 weeks · bar shows the weeks a workstream is active — several run in parallel
Final scope and sequence confirmed in discovery
Engagement tiers
What each tier includes
Rows are the capabilities named in each tier's scope. Higher tiers include everything below them.
| Capability✓ in scope · — not at this tier | PilotOne facility, one plan | ProductionProduction defence workflow | AdvancedMultiple facilities / plans |
|---|---|---|---|
| Introduced at Pilot | |||
| Evidence assembly to your steps | ✓ | ✓ | ✓ |
| Owner, operator or agent release | ✓ | ✓ | ✓ |
| Process-step inventory baseline | ✓ | ✓ | ✓ |
| Introduced at Production | |||
| Reporting by process step | — | ✓ | ✓ |
| Signing workflow in your systems | — | ✓ | ✓ |
| Approved write-back | — | ✓ | ✓ |
| Training-record integration | — | ✓ | ✓ |
| Introduced at Advanced | |||
| Multi-site plan sets | — | — | ✓ |
| Cross-step evidence packs | — | — | ✓ |
| Large step registers | — | — | ✓ |
| Multi-trigger reanalysis controls | — | — | ✓ |
| Build price | From $5,000 | From $8,000 | Custom quote |
- Final build price
- Confirmed after discovery based on integrations, workflow complexity, step register size, approval controls and deployment requirements.
- Separate from build
- Build pricing is separate from recurring Agent Care, which covers managed monitoring, evaluations, incidents and verified improvements after launch.
What we need from you
What you bring, and what we build with it
Each input maps to a piece of build scope and a week in the delivery timeline.
You bring
We build with it
01Your registered facilities and their process steps
→Step inventory mapping and evidence capture
Week 102Representative access, monitoring and training records
→Record binding, trigger logic and the evidence baseline
Week 203Your vulnerability assessment under § 121.130
→Step mapping, strategy binding and the automation boundary
Week 104Access to relevant APIs, feeds or exports
→Access, monitoring and training-source assessment, then integration setup
Week 205Plans you would not want inspected
→Reanalysis cases and failure-mode testing
Week 406What no defence plan may establish
→Completeness scoring, review routing, guardrails and release controls
Week 307An owner, operator or agent in charge to sign
→Signing workflow, then pilot and production validation
Weeks 5–6
Nothing else is required
Deployment, documentation and Agent Care handover are ours.
Delivery timeline
Four phases across six weeks
Every band below is real working time and not layout, which is why the fifth of them has to hold two.
Phase
W1
W2
W3
W4
W5
W6
- DiscoveryW1
- BuildW2 – W3
- EvaluateW4 – W5
- Pilot & LaunchW5 – W6
Week focus
W1Defence plan discovery, step mapping and the automation boundary
W2Source integration and the strategy-coverage baseline
W3Evidence assembly, trigger logic and release controls
W4Evaluation suite, reanalysis cases and failure-mode testing
W5Record integration, pilot plans and targeted corrections
W6One reanalysis cycle run under the plant manager, then Agent Care handover
- Reading the band
- Each bar spans only the weeks its own work is named for. The fifth carries a pair because the work does.
- At the end of W6
- Validation closes on live plans, and Agent Care picks up the watch.
- Duration
- Six-week plan shown · typical delivery 4–6 weeks depending on scope confirmed in discovery.
Next step · Food & Beverage AI agent
Build a food defence agent around the plan your officer has to sign and date.
Show us one actionable process step and the explanation behind its strategy. If a change went operative before the plan was reanalysed, then § 121.157 ran unmet and § 121.401 makes that a prohibited act. Preventive-controls monitoring is a different agent.
- Typical delivery
- 4–6 weeks
- Deployment
- Your process steps
- Named officer
- Two signings
- After launch
- Agent Care available
Nestack Agents · Food defence
AGT-FB-13 · Agent Care available after launch