Draft · anonymized for review
Technical Whitepaper

Reading the PO
was the easy part.

Building purchase-order automation for a regulated aerospace manufacturer — where a wrong write isn't a bug, it's a mis-scheduled or non-conforming flight part, and the data is never allowed to leave the building.

Client
Precision components mfr.
Sector
Aerospace & defense supply
Scope
Document → ERP automation
Deployment
On-premise · single-tenant
Status
Deployed · in production
Abstract

A precision-components manufacturer in the aerospace and defense supply chain was reconciling every customer purchase-order revision into its ERP by hand — reading a PDF, finding the matching sales order, and re-keying dates and quantities against live production schedules. On regulated aerospace work, a transcription slip isn't an inconvenience; it's a mis-scheduled or non-conforming part.

We built an on-premise system that reads each PO, reconciles it against the ERP, and presents a line-by-line diff of exactly what would change — and writes nothing back until a person approves it. Customer data never leaves the client's network, no third-party AI touches the documents, and every action is logged. What started as a reconciliation tool became a small operations platform: automated intake, certificate-of-conformance generation, and analytics, all built on the same trusted integration layer.

§ 01

The problem beneath the problem

Pulling fields out of a PDF is, in 2026, close to a solved problem. The difficulty sits one step later: writing the result correctly and safely into a system of record. Here, that record was a live manufacturing ERP driving real production schedules for aerospace customers — governed by three non-negotiable constraints.

Data residencyITAR
Customer PO data cannot leave the client's premises — no third-party cloud, no external AI service. The controlled environment is the boundary, and it holds end to end.
DeterminismAuditable
Extraction must be rules-based and repeatable, not a model's best guess. Every value has to trace back to a place on the page and be defensible after the fact.
Human authorityWrite gate
Nothing alters the ERP without a person reviewing and approving that specific change. Automation proposes; a human disposes.

Those three together rule out essentially every off-the-shelf document-automation product — most assume a cloud round-trip and treat the write itself as a fire-and-forget webhook.

§ 02

A reconciler, not an auto-typer

The instinct is to automate the typing. We automated the reconciliation instead, and left the decision where it belonged — with a person who is accountable for the record.

Step 01
Read

A deterministic, rules-based reader extracts each PO's line items and its "changes since last revision" — no LLM in the data path.

Step 02
Reconcile

A typed ERP client matches the PO to its sales order and computes what actually changed — due dates, quantities, part identifiers.

Step 03
Review

Proposed changes are shown as a diff — current vs. proposed, per line and per job — with mismatches and stale-revision warnings surfaced, not buried.

Step 04
Approve

A change reaches the ERP only when a person marks it approved. Each write is isolated; one failure never corrupts the rest, and every call is logged.

§ 03

Engineering for trust

In a tool that touches a system of record, "it works" is not the bar. The bar is that the people relying on it can defend what it did. A handful of decisions carried most of that weight:

Fail-closed
Permissions and controls default to no. A missing setting disables an action rather than quietly opening it.
Ask every time
There is no batch "apply all" that bypasses human judgment on a live write. Prior consent to test never becomes standing consent to act.
Total audit trail
Every API interaction is recorded with request, response, and outcome — the difference between "we think it worked" and "here is exactly what we sent, and when."
Independent review
The system was put through a full security audit; findings were fixed. It runs single-tenant, LAN-only, behind organizational sign-in.
Graceful failure
An outage in one integration surfaces as a clear message — never a half-written record.
§ 04

What it grew into

Because the integration layer could be trusted, the business kept building on it. Each addition rode the same audited, human-gated foundation.

Hands-off intake

New PO emails are pulled from a shared mailbox and run through the same pipeline automatically — no one has to remember to import anything.

Certificates of Conformance

Generated from live ERP data, so the paperwork that ships with a part always matches the record it came from.

Operations analytics

Turning noisy ERP reports into answers. One report flagged over a hundred orders as "late"; by cross-referencing each order's job status, we separated the genuinely late ones from those merely on an intentional hold — and produced the short, real "act on these" list instead of the alarming headline number.

Reverse-engineering the ERP

Where the vendor's API didn't document which field held a given cost, a small value-matching probe pinned the exact field against numbers the client already trusted — instead of guessing and shipping the wrong one.

§ 05

The lesson

Document-to-system automation is usually sold as an extraction problem. It isn't. Extraction is commoditized; the difficulty and the value concentrate on the write side — correctness, safety, and trust when the target is a system of record, and especially when the data is regulated.

The durable approach is domain-deep and trust-first: deterministic where the rules demand it, a human at the boundary of every consequential change, and an architecture where sensitive data never has to leave a controlled environment to be useful. That is not the cheapest way to move a number from a PDF into a database. It is the way a shop building flight hardware can actually rely on.

  • Manual reconciliation of every PO revision became minutes of review.
  • Customer data never left the premises, and no external AI ever saw a document.
  • Every change is logged and explainable — a record of intent, not just a result.
  • A trusted integration layer the business keeps extending, feature after feature.