Ateliersavant In-House
FORGE OS — AI-Native Procurement for Consumer Product Brands
Supplier discovery, RFQ generation and quote intelligence used to take weeks and a spreadsheet graveyard. FORGE OS does it in one session — and refuses to show you a factory it cannot prove exists.
Procurement Is Still Broken for Product Brands
For consumer product brands at growth stage, procurement is a black hole of time. Finding the right supplier for a category takes weeks of outreach, cold emails into the void, scattered spreadsheets, and decisions made on incomplete information. The process has not changed meaningfully in thirty years.
Large enterprises have dedicated sourcing teams and proprietary supplier networks. Small brands have LinkedIn, Alibaba and instinct. That gap is not a minor inefficiency — it decides product quality, landed cost, margin, and speed to market. We know the shape of it precisely because Ateliersavant has run procurement for its own brands and its clients' for nearly twenty years.
FORGE OS closes it — not by digitising the old process, but by replacing it with an execution engine that reasons about supplier compatibility the way an experienced sourcing director does, and then proves its conclusions before presenting them.
Brief the Project
Product, category, target market, commercial parameters, quality and compliance requirements. FORGE converts the brief into a procurement intelligence profile — defining what a qualified supplier looks like before any outreach begins. Saved brief templates let a brand reuse its own standards across campaigns.
Discovery, Then Verification
Discovery is search-grounded: every candidate must arrive carrying citations from live web results. Verification then runs independently — probing each claimed anchor, detecting parked and for-sale domains, and separating direct manufacturers from intermediaries and trading houses.
The Model Invented Eight Factories. They Had Confidence Badges.
Two production runs returned eight suppliers marked high confidence. Plausible company names, sensible countries, coherent capability descriptions — and dead or parked domains. RFQs were queued to addresses that had never existed. Nothing in the system was broken in a way that would show up as an error. It failed by being confidently wrong.
That is the failure mode that ends a procurement product. One buyer who emails a ghost factory and discovers it never existed stops trusting every result the platform will ever produce. Integrity of results is not a feature of FORGE. It is the product.
We rebuilt the sourcing pipeline around a single admissible standard — featured = real + reachable — and wrote the reasoning into canon so it could not quietly erode in a later sprint.
The model nominates; deterministic code admits.
A model statement about the web is a hypothesis. Only a fetch that returns is evidence. Parked landers are not anchors.
List sizes are ceilings, never quotas.
A mandatory count is a hallucination-forcing function: when the model does not know N real companies, the quota makes it invent the difference.
Verification can veto.
Every signal may downgrade score, demote tier, revoke RFQ eligibility and block registry writes. A verification layer that can only corroborate is decoration.
Unverified values are dropped, not tidied.
A guessed email with its uncertainty marker removed is a lie wearing a contact’s clothes.
Fail honestly.
A failed run shows an empty state and a retry — never template companies dressed as results.
RFQ Generation & Dispatch
FORGE drafts a calibrated RFQ per shortlisted supplier and dispatches through the user's own connected mailbox — so replies land in a real thread, in a real inbox, under the buyer's own domain. Bulk approve and bulk send exist, each behind a full recipient-list confirmation.
Nothing sends autonomously. Every outbound action is a human decision point. An AI system that commits commercially on a user's behalf without explicit approval is a liability, not a convenience.
Quote Intelligence
Supplier replies are pulled back through the same mailbox thread and parsed into structured commercial terms — unit price, MOQ, tooling, lead time, payment terms, incoterms. What arrives as five differently-formatted emails becomes one comparable table, with follow-up recommendations where terms are missing or evasive.
The Operations Console
A sourcing manifest of discrete procedures across the lifecycle — discovery, RFQ, sampling, negotiation, production — each with an explicit approval gate. The console is the single view of where a project actually stands, with a full audit log beneath it.
FORGE augments procurement judgement. It does not replace it. Every gate is a human decision, and that constraint is the trust model rather than a limitation of the build.
A Policy Says We Won't. An Architecture Says We Can't.
Supplier pricing and factory relationships are among the most commercially sensitive assets a product brand holds. A platform that accumulates them across its whole customer base is one breach — or one change of ownership — away from being the most dangerous file cabinet in the industry.
FORGE is built so that accumulation is structurally impossible rather than merely prohibited. The control plane holds identity, workflow state and metadata references. Operational data — RFQ bodies, reply text, quoted prices, supplier contacts — lives in storage the user owns and their IT department already governs: their Sheets, their Drive, their Box. If the column does not exist, the data cannot be retained.
Structural non-retention
The steady-state schema has no column for RFQ text, reply bodies, unit prices or supplier contact details.
Reversibility
Any provider connection is revocable in one action. The data was never FORGE’s — disconnection simply removes access.
Scope minimisation
Each integration requests the narrowest workable scope: one workbook, app-created files only, send-and-read on a single mailbox.
Independent auditability
A user’s own Google or Box account security page shows exactly what FORGE can reach. Access is not hidden; it is verifiable.
The same document that defines those properties also names their warning signs — a new column holding email content, a convenience cache that outlives a session, telemetry carrying supplier names, an OAuth scope wider than the published list. Written down as violations rather than judgement calls, so that the model degrades loudly instead of quietly.
Shipping AI Inside a Sixty-Second Window
Full supplier generation is a large reasoning job — scoring, rationale, detail fields, RFQ bodies and outreach drafts. Measured end to end as a single call it ran to roughly 110 seconds. The serverless platform terminates functions well before that, so in production the feature silently fell back to template data while working perfectly in local development. Worse, when the call did complete it truncated at its token ceiling and returned an empty category without complaining.
The fix was to stop treating generation as one request. It now runs in phases, each sized to its own time budget: a fast first pass returns names, countries, scores and rationale so the interface can render in around thirty seconds; enrichment then runs in small background batches with independent fallbacks; the analysis pass gets its own budget entirely. The user sees results almost immediately and detail fills in behind them, resuming on reload if interrupted.
Out of it came a sizing rule we now apply to any model call inside a serverless route — estimate output tokens, divide by measured throughput, and budget against the platform deadline rather than hoping. And a second, harder-won rule: a fresh project seeded with template data must never be mistaken for a project that has already generated results. That regression shipped once, and it is now a named check in the repository's own agent instructions.
Built as a Business, Not a Demo
A credit-metered tier ladder from free trial to enterprise, with the gate enforced server-side before any model call and bypassable by no user role — including the owner. Around it: organisations, team seats, shared supplier history with tier-based retention, reusable brief templates, white-label branding as a paid add-on, and PDF export.
Beta ran as a closed operator programme — individually codenamed invitations, each tester bringing their own model API key held encrypted at rest, with a shared feedback channel where every report was visible to every other tester rather than disappearing into a private inbox.
Category thesis
The gap between enterprise sourcing capability and growth-brand reality, identified from our own operating history rather than desk research.
Product architecture
Orchestration layer over data warehouse; the boundary written as canon, with anti-patterns catalogued so future work cannot drift across it unnoticed.
Interface design
A procurement console in an operator register — dense, monospaced, terminal-adjacent — designed for someone who lives in it daily.
AI systems engineering
Search-grounded discovery, deterministic verification, phased generation within serverless limits, and structured extraction from unstructured supplier replies.
Trust & privacy model
User-owned storage, minimal scopes, anonymised telemetry, and enterprise security answers that hold structurally rather than contractually.
Commercial layer
Tiering, credit metering, subscription billing, organisations and seats, white-label, and an ungameable server-side gate.
Quality infrastructure
End-to-end browser test suite and CI gating on lint, build and health across every push.
Beta programme
Closed operator cohort, bring-your-own-key architecture, onboarding flow, and an in-product reporting channel.
FORGE is one of the in-house platforms Ateliersavant operates on its own account. We build our own tools on the same standards we apply to client mandates — which is why the failures are documented here rather than edited out.
Next Case Study