Food safety & quality operating system
What is supposed to happen here?
The approved procedure, limit and owner for every check.
Was every check done—on time?
Expected records, recorded where the work happens.
Is anything outside its limit?
A rule compares every reading with its approved limit.
Which lot is this—and where did it go?
Supplier, lot, batch and shipment, one step back and forward.
Who decided, and on what evidence?
A named person, a signed decision, a linked evidence trail.
Five questions. One system.
Every answer the auditor asked for is already linked.
One event through the operating chain
For this fictional storage check, the approved maximum is 4.0°C. That value belongs to a versioned specification—not to an AI suggestion.
Human decision: A qualified person approves the control.
An operator records 5.2°C for cold storage and links the observation to lot 18A. The original reading stays in the trail.
Human decision: The observation is recorded, not interpreted as a release decision.
5.2°C is above the illustrative 4.0°C maximum. Event QE-082 is awaiting review; this flag alone does not decide whether the product is safe.
Human decision: Human review required. No release decision recorded.
Review door-opening history, equipment checks and the measurement itself. A possible cause is not accepted simply because an assistant proposed it.
Human decision: The investigator reviews the conclusion and its evidence.
The example links a proposed hold and corrective action to QE-082. A qualified person must decide product disposition; this illustration does not release or close anything.
Human decision: Approval, disposition and closure remain human-owned.
Lot 18A stays linked to its receipt, production batch and any shipment record. A trace link identifies context; it does not prove that a recall has been completed.
Human decision: The responsible team confirms the affected scope.
Review the follow-up readings and measurement checks before considering closure. A completed task and an effective corrective action are different things.
Human decision: A verifier confirms effectiveness; unresolved gaps remain visible.
The example package brings SPEC-CS-04, TEMP-082, QE-082 and the review trail together. Its review state keeps outstanding decisions visible; no finished audit outcome is implied.
Human decision: Authorized people approve the package and any subsequent changes.
Rev 2 is retained as obsolete—never overwritten.
The schedule knows the 16:10 check is expected. If it is missed, that becomes visible too.
Arithmetic is not left to AI. The rule decides in or out; a person decides what it means.
Two similar events in 12 months (QE-061, QE-074) on the same door. Consider adding seal inspection to preventive maintenance.
Sources linked · needs review by the investigation leadRequires an authorized signature. The gate keeps the lot from shipping until then.
The same genealogy drives mock recall and recall: affected lots, quantities and customers.
The snapshot keeps the record state at the time it was made. Gaps stay visible.
The evidence graph
Fictional case. Each dashboard number in the product is meant to open this graph—not a summary of it.
Inside the product
Each domain shows its worst open record—not a score. Overdue CAPA, a missing CCP record, lots on hold.
Exceptions from cold chain, inspections, suppliers and complaints share one event model and one trend.
The event shows its originating control: CCP-02, the approved limit, the observed value and the deterministic check that raised it.
Device streams, monitoring forms and photos are attached with who uploaded them, when, and a content hash.
The event cannot close while a linked CAPA is open, a hold is active or a disposition is pending.
HACCP control, SOP, form, hold, investigation, CAPA, lot and batch—one graph, one click away.
Existing prototype · fictional sample records · not a live customer deployment
Who does what
Rules that can be checked are checked by the system. Judgement that carries accountability stays with qualified people. AI helps in between—and the core keeps working without it.
Compare, schedule, block and propagate—exactly as the approved rule says.
Works when AI is unavailable.
Summarizes, drafts and points to what is missing—always with its sources.
Never invents a reading, closes a CAPA or decides disposition.
Decisions that carry accountability are signed by a named, qualified person.
Form completer ≠ verifier. CAPA owner ≠ effectiveness approver.
Record integrity
A submitted record keeps its original value. A correction adds who, when and why. A signature states what it means and binds to the version it signed—change the content, and the signature does not carry over.
No release or closure is implied. This is a fictional workflow, not a food-safety instruction.
Clear boundaries
It connects to these systems and roles. It does not replace them.
A full system. An explicit status.
Every capability carries one label. A later capability is still part of the system—it is just not available today.
Labelled current in the source register; available to explore in demonstrations.
Partial structure or workflow; still taking shape in development.
Intended scope. Not available today and not a delivery promise.
Browse the capability register →Trade is an optional extension for applicable operations—not the centre of the quality system. Explore Trade
A practical place to start
A recurring exception. A difficult handoff. An audit trail that takes too long to reconstruct. Start with the work your team already knows.
Request a workflow reviewFirst, check your workflow