One capability boundary for a real business workflow.
The Foundgine Supply Chain case turns a realistic supply-chain domain into an application-controlled capability surface for AI agents. The same semantic model carries intent through authorization, planning, ExecutionIR and PostgreSQL—while the benchmark suite measures agent work and the PenTest suite attacks the boundary.
From an agent's request to an authorized database operation.
This is deliberately more than a CRUD demo. The agent selects a business capability; it does not receive authority to invent SQL, bypass ownership, choose protected fields or rewrite the application's authorization model.
The application exposes business capabilities, not database primitives.
Orders & ownership
Read customer orders and order details while ownership rules remain server-controlled. Cross-customer access is treated as a security boundary, not a prompt convention.
PlaceOrder
Resolve products, validate quantities and inventory, calculate price server-side, write order state atomically and enforce replay protection.
Inventory operations
Expose inventory reads and updates only to authorized warehouse/procurement actors through the same application capability model.
Shipments
Create and update shipment state with role-aware controls and warehouse allocation carried through fulfillment and cancellation.
Products & suppliers
Expose supplier and product discovery to procurement roles without making the transport adapter responsible for business authority.
Traceable plans
Semantic plans are lowered through ExecutionIR and receipts retain evidence such as a plan fingerprint before physical execution.
What the measurements actually show.
The benchmark story is intentionally split into measured comparisons and modeled estimates. This avoids turning a useful agent-work signal into an unsupported performance claim.
| Experiment | Measured result | What it means |
|---|---|---|
| Run 1 · conventional vs Foundgine | 7 → 4 tool calls; 932 → 534 estimated context tokens; 12.69 → 24.25 ms wall time | Strong early evidence of reduced agent/application work, with an execution-latency trade-off that should not be hidden. |
| Run 2 · customer tiers / concurrency | 9 → 6 tool calls; ~26.5% lower estimated context; published cells reported 100% request success | The agent-work reduction persisted as workload size and concurrency increased; this run is not a claim that Foundgine is always faster. |
| Supply Chain E2E | 25 operations; 43.2 ms average latency in the published fixture | Demonstrates a stateful capability workflow rather than an isolated microbenchmark. |
Run 1 and Run 2 are live conventional-vs-Foundgine experiments. The Supply Chain E2E page also contains a modeled efficiency estimate for its standalone workload; that estimate is explicitly not a measured conventional comparison.
The same case is attacked from both sides of the transport boundary.
The Foundgine.SupplyChain.PenTest sample puts MCP and GraphQL over the same
application and infrastructure layers. Its deterministic regression suite covers
authentication, BOLA/IDOR, role escalation, injection-shaped input and information
leakage.
7 penetration cases
Missing credentials, invalid tokens, identity ambiguity, cross-customer access, capability escalation and injection-shaped data are exercised through MCP.
7 penetration cases
The same security invariants are exercised through GraphQL so the transport adapter cannot become a policy bypass.
14 deterministic cases
The cases are executable security tests, not screenshots or prose claims. The E2E benchmark can merge their TRX timings into the application report.
The currently published Supply Chain fixture records 9 unexpected unauthorized successes. That is a benchmark/security signal to investigate, not something this case study presents as a passing security result. The PenTest suite and the latest E2E run should be rerun after authorization expectations are corrected.
This page intentionally keeps that result visible rather than converting an unfinished benchmark into a marketing claim.