- A booking agent tickets your flight. The hotel step fails. With no undo logic the LLM still says "You're all set!" Now the traveler has a flight and no room, and the deployer owns every word (Moffatt v. Air Canada, BC CRT, 2024). So we took the LLM out of the control flow. 🧵
- The failure isn't model IQ. A rate expiring between two API calls, a hold rejected after a ticket issues, a search storm burning margin. Those are infrastructure events. A perfect model still strands the traveler if nothing voids the ticket.
- So the control flow is deterministic Python: a hand-built ~10-node state machine (search, policy, verify, hold, ticket, hotel-book, commit). The LLM is confined to two leaf jobs, parse the trip into a typed object and word the final reply. Agents advise, code decides.
- The part most demos skip: every forward step registers its reverse the moment it runs. Ticketing registers "void ticket, 24h window." On a partial failure the engine replays those compensations in reverse. A Saga. The world is never left half-booked.
- One scenario, side by side. Flight plus hotel, the rate expires AFTER the flight is ticketed. Ours: ticket ok, hotel-book fails, Saga fires, void inside the 24h window, honest reply "voided, no charge, alternatives sent." Terminal state: rolled_back.
- Same scenario through a real ReAct LLM-in-control baseline (an honest anchor, not a strawman): ticket left issued, no compensation, false "You're all set!" Terminal state: STRANDED. An Air Canada precedent waiting to happen.
- We ran the same 200 synthetic bookings, one fixed seed, the same injected failures, through both. Ours: 100% consistent terminal state, 0 stranded. Baseline: 65%, 40 stranded. By construction over that fixed-seed batch, not an open-world guarantee.
- The guarantee comes from deterministic compensation, not a better prompt. Ten 90%-reliable steps end to end is 0.9^10, about 34%. GPT-4 plus ReAct finishes real itineraries at 0.6% (TravelPlanner, OSU NLP, arXiv 2402.01622). You can't prompt your way out of that.
- Builders: what is the last transactional step in YOUR agent with no registered undo? That one step is where the stranded customer comes from. Curious where others draw the line between what the model decides and what code decides. #AgenticAI #LLMOps #AIGovernance #TravelTech
- We built this to be run, not just read: deterministic control flow, the Saga rollback, a verification gate that abstains on unconfirmed inventory, and an exportable audit trail with an EU AI Act Article 50 flag. See it live: https://veriprajna.com/demos/agentic-travel-booking
Published on X · July 28, 2026
On social media
See this post on its original platform
In our archive