VoltStream Mobility — a charging-law compliance engine, with an agent that cannot invent law
A German EV charging supplier CRM that grew into a MessEG/MessEV compliance engine — with an Agentforce agent as its interface and a deterministic gate that stops it citing law no action returned.
- Year
- 2026
- Role
- Salesforce Developer
- Tech stack
- Agentforce (Agent Script)GenAiPlannerBundleAgentforce Testing Center (aiEvaluationDefinition)Apex (Batch, Schedulable, @InvocableMethod)Custom Metadata Types (legal corpus)External Credentials + Named CredentialsLightning Web ComponentsTrigger Framework (Kevin O’Hara)Selector patternOpenStreetMap Overpass APIOCPI (Open Charge Point Interface)GitHub Actions (split CI)MessEG / MessEV (German calibration law)
Highlights
- The engine decides, the agent explains — legal status per record is a formula field you can sort a list view by; chronology a formula cannot express is Apex. No date arithmetic exists on the agent’s side of the call, so it cannot make a legal decision even if instructed to
- This was measured, not anticipated: during the build the agent answered the same question twice and gave two different wrong answers, both phrases lifted from its own instructions, because a misconfigured action never ran — and it sounded correct in German both times. The architecture exists to remove that failure mode (ADR-009)
- Transcript gate — every § the agent utters must appear in what an action returned for that question. No model, no embedding, no threshold: a citation was either handed over by the engine or invented, and that is binary. The gate proves on every run that it can fail
- 25 real Berlin charge points imported live from OpenStreetMap (Allego, Vattenfall, Shell Recharge, Berliner Stadtwerke, E.ON) — every one evaluates to UNBEKANNT, because no public charge point database carries what German calibration law requires. A missing date is not a clean bill of health
- The law is versioned metadata: 16 provisions as Custom Metadata with verbatim wording and validity dates. Two records are deliberately text-free because the original was not read — a paraphrase there would defeat the grounding design
- The reference date is a parameter, never TODAY(), so a test can assert the last lawful day and the first unlawful one on identical records — and an audit can reproduce what the engine said in March
- 191 test methods across 27 test classes, counted from source (Aug 2026), over 24 production classes
- Split CI: the deterministic half — Apex, the formula-versus-engine consistency check, the utter-only-what-you-cite invariant, an umlaut audit — runs on every push and costs nothing. The agent gate runs on demand, because a published agent and 150 generations an hour are not something a scratch org has
- 18 architecture decision records, including one that keeps a formula field known to be wrong in a single case — with a test asserting the divergence so it cannot be silently repaired
- An Honest limits section names what the gate does not catch: a wrong Absatz inside a correct paragraph, a presumption the engine answers UNBEKANNT to rather than resolving, and an ordinance section that was not read
The problem
German calibration law decides whether a charge point may lawfully bill a customer. The answer depends on dates — placing on the market, calibration, re-calibration — and getting it wrong in fluent German is worse than not answering, because it is believed. During the build the agent proved the point: asked the same question twice, it produced two different wrong answers, both lifted from its own instructions, because a misconfigured action never ran. Nothing in the response indicated that no computation had happened.
Architecture
Trigger → Handler → Helper → Selector on the Kevin O’Hara framework, with the legal engine as a pure function of its inputs — the reference date is a parameter, never TODAY(), so the same facts always produce the same answer and an audit can reproduce what the engine said on any past date. Agentforce sits on top through invocable actions that resolve records, call the engine, and return its sentences unchanged. The OCPI import token lives in an External Credential and is never read by Apex; the OpenStreetMap import needs no key at all.
The approach
The engine decides and the agent explains. Legal status per record is a formula field visible in a list view; chronology a formula cannot express is Apex. The agent picks which deterministic check runs and narrates the result in German — and cannot do more, because no date arithmetic exists on its side of the call. A gate then checks it kept its place: every paragraph it utters must appear in what an action returned, a binary check with no model and no threshold, which proves on every run that it can fail. The law itself is 16 Custom Metadata records with verbatim wording and validity dates, deployed rather than typed, so every legal change arrives as a reviewed diff.
The outcome
25 real Berlin charge points were imported live from OpenStreetMap — no API key, no account — and every one of them evaluates to UNBEKANNT, because no public charge point database carries what a metrology question requires. That is the finding, not a gap in the demo. 191 test methods across 27 test classes cover 24 production classes, the deterministic half of CI runs on every push, and an Honest limits section names what the gate does not catch, including a wrong Absatz inside a correct paragraph.