Work packets & grounding · LendEasy Docs

Give one AI session the minimum facts, evidence, tools, budgets, prohibitions, and policy versions needed for one task—and require every consequential claim to cite them.

A work packet is a signed, immutable capability envelope assembled for one session. It is not a prompt assembled from every field the current user can see.

Packet anatomy

{
  "workPacketVersion": "wp_2027-04-1",
  "objective": "Summarize Harbor collections context and recommend a next step.",
  "case": {
    "caseId": "case_HBR_COL_51",
    "caseType": "collections",
    "stage": "contact_strategy"
  },
  "allowedFacts": [
    {
      "name": "loan.amountPastDue",
      "value": { "amount": "517.14", "currency": "USD" },
      "source": "authoritative_core",
      "asOf": "2027-05-01T10:11:56-07:00",
      "evidenceId": "evd_FACT_81"
    }
  ],
  "allowedOutputs": ["case_summary", "next_action_recommendation"],
  "allowedTools": ["read_case", "evaluate_contact_eligibility", "submit_ai_output"],
  "prohibitedActions": ["send_interaction", "submit_loan_action", "read_payment_credentials"],
  "budget": { "toolCalls": 10, "tokens": 8000, "expiresInSeconds": 900 },
  "policyBundle": "collections-assistant-us-ca-v8"
}

The packet carries resource versions and a digest. A tool rejects a call if the session is expired, the resource version is incompatible, the tool is absent, or the requested subject lies outside scope.

Data minimization

Include facts required for the objective, not the entire case file. A collections-summary packet may receive masked contact state and amount past due but not raw identity tokens, payment credentials, unrelated loan history, or restricted hardship documents.

Data	Default treatment
Account and card credentials	Never available to an AI packet.
Government identifiers	Masked status only when the task truly needs it.
Restricted notes/documents	Excluded unless task, role, and policy explicitly permit.
Financial facts	Canonical typed value with source, as-of time, and evidence ID.
Customer-authored content	Untrusted evidence, never control instructions.

Structural grounding

Grounding is enforced in the output schema, not left to a prose instruction. A recommendation cites evd_FACT_81; a borrower-facing draft uses a typed variable bound to that fact. Unsupported literal financial claims fail validation.

{
  "type": "next_action_recommendation",
  "content": "Offer the in-policy two-installment promise option.",
  "citations": [
    { "fact": "loan.amountPastDue", "evidenceId": "evd_FACT_81" }
  ],
  "confidence": "high"
}

Freshness

The packet freezes what the agent saw; execution tools still read volatile facts again. A summary can state “as of 10:11:56,” while an outbound interaction must use a new compliance decision at send time.

Prompt injection containment

Customer messages, uploads, websites, and transcripts are labeled untrusted content. They cannot add tools, alter prohibitions, change identity, grant consent, suppress required work, or modify system instructions. A detected manipulation attempt becomes evidence and may route to review; it does not become a command.

Reproducibility

Store the packet digest, model, model configuration, prompt/template version, output schema, tool requests/responses, and policy bundle. Reproduction means reconstructing the inputs and controls—not promising a stochastic model will emit byte-identical prose.

If a required authoritative figure is unavailable or stale, return missing_facts. Estimating a balance, payoff, amount due, APR, or customer commitment is never an acceptable fallback.