Governed workflows, not just fast ones
Action Factory runs the workflow around the model. It assembles steps from components someone already certified, refuses to finish anything without a person approving it, and writes every step to a record you cannot quietly edit.
The platform tier of the Factory Suite · Every station run dispatches through this engine
The cost of work nobody can vouch for
Output produced without a record costs you the same three things every time somebody asks how it happened.
Cost · The record
Six weeks later a client asks who signed off on a number. The answer is in somebody's memory, or a chat thread, or nowhere at all. None of those is an answer you can give them.
Cost · The gap
A workflow missing a piece does not stop politely and ask. It improvises, and the improvisation ships looking exactly like the parts that were checked.
Cost · The blast radius
Isolation that lives in application code holds right up until the one query that forgot about it. You find out from the person who received the wrong document.
Faster output · work you cannot stand behind
What you get
Approvals
A generated artifact stops at a human-approval step and waits. The engine will not mark it final on its own. That is an invariant of the system, not a setting somebody can turn off on a deadline.
Audit ledger
Every state change appends to a hash-chained ledger. Removing an entry breaks the chain, which is the entire point of chaining it. What happened stays legible months later.
Component gaps
Where no certified component covers a step, the workflow refuses to publish. It stays blocked until somebody who holds the authority to close that gap closes it, on the record.
Capabilities
Who may resolve a gap, publish a version or approve an artifact is a capability someone holds, checked on the server on every request. Hiding the button is not the control.
Tenant isolation
Row-level security scopes every query to the acting tenant, so an out-of-scope row is indistinguishable from one that does not exist. A forgotten filter cannot leak what the database will not return.
Across the suite
Funnels, decks and newsletters all dispatch their runs through this engine. Work that crosses stations is still one audited chain rather than three disconnected stories.
Why trust the engine
Nobody wants another dashboard. What is actually missing is the boring half: the record, the refusal, the permission check. That half is what this is.
Funnel Factory, Deck Factory and Press Factory each dispatch their runs through Action Factory. It is not a side project. It is the thing three shipping products depend on.
Three properties hold on every code path, for every role: no unaudited cross-station call, no machine-written final artifact, and tenant isolation on every boundary crossing.
Tenant scoping is tested at three levels, including a row-level security lane that runs against a real Postgres instance instead of a mock that agrees with itself.
The whole platform
Work arrives through a funnel, dispatches through Action Factory, and comes out the other side as a deck, a newsletter — or another funnel. That last one is the interesting case: a funnel is an intake mechanism AND a generated artifact, so what the engine produces feeds back into the engine and improves it.
An automated brand identity pipeline. Give it a brand and it produces the token set every station renders through, so a re-skin is a data change rather than a rebuild.
A voice-captured rich content pipeline. Speak the substance once and it becomes structured material the stations can publish, instead of a transcript somebody still has to rewrite.
Distils complex material into simple turn-based tasks with AI recommendations. Action Factory is built to lean on this one heavily: the engine governs the turns, Distillery decides what the turns should be.
IN DEVELOPMENT · NOT YET AVAILABLE
How it works
You are not assembling a pipeline. You are saying what should happen and then deciding whether what came back is good enough to send.
01
Describe the outcome. The engine assembles the steps from components that have already been certified, rather than inventing them on the spot and hoping.
02
Anywhere a step is uncovered, the workflow stays blocked and tells you which piece is missing. Somebody with the capability resolves it, and that decision is recorded with their name on it.
03
The run executes. Approval and human-input steps stop and wait for a person. Every step appends to the ledger as it goes, so the record is written while it happens rather than reconstructed afterwards.
What it is, plainly
You describe an outcome. It assembles the steps from certified components. It refuses to publish where a step is uncovered. It stops at a person before anything becomes final. It writes the whole thing to a hash-chained ledger while it happens.
None of that is bolted on afterwards, which is the only reason it holds. A record you can switch off is not a record, and an approval that a deadline can skip is not an approval.
It is the platform tier of the Factory Suite, and the other three stations run their work through it. If you are accountable for something a model produced, this is the part that lets you show how it happened.
If you are the one who has to answer for work a model produced, you need more than the work. You need to be able to show who decided what, and when.