Skip to content

docs(commercial): address the partner, not the sales team #191

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abrichr merged 1 commit into from
Aug 31, 2026
Merged

docs(commercial): address the partner, not the sales team #191

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 16 additions & 26 deletions docs/commercial/oem-brief.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,12 +27,6 @@ A sealed verified run prints `VERIFIED`, a seal id, and
`--seal` on replay is the intended Seal command. `openadapt flow seal`
encrypts a bundle for deployment.

The buyer is the technical owner at a vertical software vendor, an RCM
provider, a BPO, or an agent platform. That company already has structured
inputs, business logic, and an exception team. OpenAdapt supplies the last
action in the customer GUI, then a Seal. Health-system IT is a downstream
environment. Do not staff this motion as an IDN RFP.

!!! note "Private pilot. Not a public API."
This page describes the private-pilot product contract. It is not an
self-service integration recipe and it does not publish partner access,
Expand Down Expand Up @@ -145,25 +139,27 @@ does not infer a class or an identity from a screenshot, OCR, an application
name, parameters, or a model. If the class is unavailable, it uses `record` or
`item`. The runner rechecks the real identity before any resumed action.

## Two sales motions

Do not mix these in one pitch.
## Attended and unattended operation

**Attended.** A person is in session. The runner uses that session. Consequential
writes pause for a signed phone or console answer, then recheck live identity
and state. This is the motion you can sell now. The human remains the legal
actor. A Seal is not a physician signature.
The private pilot runs attended. A person is signed in to the target
application, and the runner acts inside that session. A consequential write
pauses at `decision_required` until an authorized person answers, and the
runner rechecks live identity and workflow state before it continues. The
[attended decisions](#attended-decisions-and-mobile-delivery) section below
describes that round trip.

**Unattended.** Needs a dedicated agent identity, PAM, and session recording. It
does not type a physician password or stuff a physician login.
That person stays the legal actor. A Seal records that the configured
authorization, identity, postcondition, and effect contracts passed for one
run. A Seal is not a physician signature.

Halt UX is the commercial product: who gets the push, what they see, how they
teach one step without invalidating the bundle, and how "click continue" is
refused.
Unattended operation is qualified separately and is not part of the private
pilot. It requires a dedicated agent identity, privileged access management,
and session recording. In either mode, OpenAdapt does not type a person's
password, reuse a person's login, or share a service account.

## Oracle tiers

Charge 2 and 3. Tiers 0 and 1 never mint a production Seal.
Only a tier 2 or tier 3 oracle mints a production Seal.

| Tier | What it reads | Production Seal |
|---|---|---|
Expand Down Expand Up @@ -236,7 +232,7 @@ the Seal. Map the receipt fields 1:1.
| `execution_id` | The `POST /v1/executions` that produced this Seal |
| `workflow_digest`, `workflow_version` | Admitted program |
| `qualification_id`, `environment_id`, `runner_id`, `nonce` | Admission, environment, runner, uniqueness |
| `oracle_tier` | 0 visual, 1 second-session, 2 SoR, 3 counterparty |
| `oracle_tier` | 0 visual, 1 second-session, 2 system of record, 3 counterparty |
| `outcome` | `verified` / halt / `reconciliation_required` / the other terminal values |
| `contracts` | Authorization, identity, postcondition, effect |
| `evidence_digest` | Pointer to retained evidence. Bytes stay in the boundary. |
Expand Down Expand Up @@ -287,12 +283,6 @@ commercial compatibility pack.
| OpenAdapt Execute | Private pilot | `POST /v1/executions` issues Seals. Not a new repository. |
| Compatibility packs and verifier recipes | Commercial | Per-application and per-environment qualification assets. Bundles are not liquid. |

Embed through Execute and MCP into RCM vendors and agent platforms. Hospital
IT RFPs are not the growth engine. If Copilot or Power Automate already
clicked, OpenAdapt can still emit the Seal when asked.

The compiler stays inspectable. Settlement is the Seal.

## Next step

[Qualify one workflow](qualification-sprint.md){ .md-button .md-button--primary }
Expand Down
19 changes: 10 additions & 9 deletions docs/commercial/procurement-faq.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,15 +86,16 @@ No. The human remains the legal actor. A Seal records that the configured
identity, policy, and effect checks passed for that run.

**Do you sell attended and unattended as one product?**
No. Attended is the motion you can buy now: human session, phone or console
approve consequential writes. Unattended needs a dedicated agent identity,
PAM, and session recording. Do not mix them in one statement of work. Do not
type a physician password.

**Are we buying a hospital RFP engagement?**
No. Embed through Execute and MCP into an RCM vendor, BPO, vertical SaaS, or
agent platform. Health-system IT is a downstream environment. IDN procurement
is not the growth path.
No. Attended is the mode you can buy now: a person is in session, and a phone
or console answer releases each consequential write. Unattended needs a
dedicated agent identity, privileged access management, and session recording,
and it is qualified separately. One statement of work covers one mode.
OpenAdapt does not type a person's password.

**Does this need a health-system IT procurement?**
No. OpenAdapt embeds into your product through Execute and MCP, and your
company holds that integration. The health system is the environment where the
transaction runs.

**Can Copilot or Power Automate still do the click?**
Yes. OpenAdapt can emit a Seal from another actuator when asked. The
Expand Down
5 changes: 3 additions & 2 deletions docs/commercial/qualification-sprint.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,9 @@ Days on which access is broken or revoked pause the clock. See the
confirmation is oracle tier 0 and never a production Seal. See
[effect verification](../concepts/effect-verification.md) and
[The Seal](seal.md).
- The sales motion: attended (human session, phone approve writes) or
unattended (dedicated agent identity, PAM). Do not mix them in one sprint.
- The operation mode for the workflow: attended (a person is in session and
answers a pause from a phone or console) or unattended (a dedicated agent
identity and privileged access management). One sprint qualifies one mode.
- A security contact for boundary and data-handling questions.

## Exclusions
Expand Down
48 changes: 18 additions & 30 deletions docs/commercial/seal.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,16 +19,15 @@ failure: if a consequential tool returns done without a Seal, treat the call as
failed.

The compiler stays MIT. Record, compile, replay, halt, teach, `openadapt-types`,
local MCP, and Agent Skills stay inspectable. Settlement is the Seal.
local MCP, and Agent Skills stay inspectable.

Public verify pages list synthetic and non-PHI Seals. They do not list
healthcare production. Bundles are bound to one app build, one farm, one
resolution, one custom screen. Do not publish a public healthcare procedure
npm.
resolution, one custom screen.

## Oracle tiers

Charge tiers 2 and 3. Tiers 0 and 1 never mint a production Seal.
Only a tier 2 or tier 3 oracle mints a production Seal.

| Tier | What it reads | Production Seal |
|---|---|---|
Expand All @@ -49,24 +48,20 @@ banner must halt. The store must stay unchanged.
A Seal that points at a screenshot hash is a liability. Do not mint production
`verified` below tier 2.

## Two sales motions
## Attended and unattended operation

Attended and unattended are two motions. Do not mix them in one pitch.
Attended is the mode available now. A person is already signed in to the
target application and the runner acts inside that session. A consequential
write pauses at `decision_required`. The operator answers from the local
console or the authenticated phone surface. The runner then reacquires focus,
a fresh observation, identity, and the target before it continues.

**Attended.** A person is already in session. The runner uses that session. A
consequential write pauses at `decision_required`. The operator answers from
the local console or the authenticated phone surface. The runner then
reacquires focus, a fresh observation, identity, and the target before it
continues. This is the product you can sell now. The human remains the legal
actor. A Seal is not a physician signature.
That person stays the legal actor. A Seal is not a physician signature.

**Unattended.** Needs a dedicated agent identity, PAM, and session recording.
It does not type a physician password, stuff a physician login, or share a
service account. Treat that as a later motion with its own identity design.

Halt UX is the commercial product. Who gets the 2 a.m. push, what they see, how
they teach one step without invalidating the bundle, and how "click continue"
is refused: that is renewal.
Unattended operation needs a dedicated agent identity, privileged access
management, and session recording, and it is qualified separately. In either
mode, OpenAdapt does not type a person's password, reuse a person's login, or
share a service account.

## CLI story

Expand Down Expand Up @@ -107,7 +102,7 @@ on that page.
| `environment_id` | environment | The qualified environment |
| `runner_id` | runner | The customer-controlled runner |
| `nonce` | nonce | Per-Seal uniqueness so a consumer does not need the original request |
| `oracle_tier` | oracle | 0 visual, 1 second-session, 2 SoR, 3 counterparty |
| `oracle_tier` | oracle | 0 visual, 1 second-session, 2 system of record, 3 counterparty |
| `outcome` | outcome | `verified`, `halted_before_effect`, `reconciliation_required`, `rejected_policy`, `failed_platform`, or `rolled_back_verified` |
| `contracts` | contracts | Authorization, identity, postcondition, effect, required and observed strength, `model_used`, `external_network_used` |
| `delivery_uncertain` | delivery | True when a write may have landed |
Expand Down Expand Up @@ -138,17 +133,10 @@ The partner still validates the Seal the same way: `receipt_id`,

## How it ships

The buyer is the technical owner at an RCM vendor, BPO, vertical SaaS, or
agent platform that already finishes last-mile work in someone else's GUI.
Health-system IT is a downstream environment. IDN RFPs are not the growth
engine.

Embed through Execute and MCP. One partner is many environments. A hospital
procurement cycle is 12 to 18 months.
A partner embeds OpenAdapt through Execute and MCP.

If Copilot, Power Automate, or another actuator already clicked, OpenAdapt
can still emit the Seal when asked. We do not need to win the chat box. Until
a counterparty demands the Seal, the incumbent keeps distribution. Coexist.
If Copilot, Power Automate, or another actuator already clicked, OpenAdapt can
still emit the Seal for that action when asked.

Compile-once is a cache when the job is stable. If a computer-use agent gets
cheap, the run still has to prove identity and effect, or halt.
Expand Down
Loading