Skip to content
say hello

// projects · case study

AI video production with people in control

04 / client name private

Back to all projects
case-04.video-workspace
04

Video productionAI video production workspace

Client name private

// what we built

We built a video workspace where AI helps with research, planning, and production while people approve creative choices, costs, rights, and the final result.

Product
AI video production workspace
Field
Video production
Technical layers
04
Safeguards
06

The challenge

What the team needed to solve

Making video with AI still involves creative judgment, source checking, media rights, expensive provider calls, and long-running work. Teams need clear approval points instead of handing the whole process to a generate button.

What we built

How the product works

The workspace guides a brief through research, planning, generation, editing, and final review. People can choose concepts, answer questions, approve spending, revise scenes, go back, cancel work, and withhold final approval until quality and rights checks pass.

architecture-inspection.map
01

Architecture inspection

The model is one participant in a typed workflow. These notes mark where responsibility, authority, and recovery live.

// system mapHuman-gated video pipelineAI video production with people in control
  1. sourceBriefaudience + objective
    sourceAssetsbrand + footage
  2. agentIdeaangle + treatment
  3. agentResearchclaims + references
    agentPlanscript + shot list
  4. human gate
    humanRights + budgetapprove before spend
  5. agentGeneratevoice + scenes
    agentEdittimeline + captions
  6. logicQAspec + continuity
    humanFinal reviewaccept or revise
    outputRelease masterapproved + versioned
  1. 01

    Brief and asset intake

    Responsibility
    Capture a structured brief and attach hashed source assets through signed object-storage uploads.
    Boundary
    The browser hashes files in a worker, while upload authorization and provider credentials remain server-side.
    Failure path
    Reject an unauthenticated or invalid upload and keep service tokens out of browser responses and logs.
  2. 02

    Idea and research plan

    Responsibility
    Generate selectable concepts, collect answers, and build a research-backed plan before media generation.
    Boundary
    External claims carry a source, excerpt, confidence, risk, and content hash into later stages.
    Failure path
    Keep unresolved or high-risk claims visible for revision rather than presenting them as approved evidence.
  3. 03

    Human approval gates

    Responsibility
    Pause for concept choice, questions, spend or provider interrupts, rights confirmation, and final approval.
    Boundary
    Consequential transitions require an explicit operator action and may be revised, cancelled, or backtracked.
    Failure path
    Hold the workflow at its current stage when approval, consent, rights, or a required answer is absent.
  4. 04

    Generation and version lineage

    Responsibility
    Generate and edit scene artifacts while linking each version to its inputs, revisions, hashes, and predecessors.
    Boundary
    Preflight quotes, stage ceilings, explicit spend extensions, and immutable artifact identity constrain provider work.
    Failure path
    Interrupt before excess spend and preserve the last accepted artifact version when generation or editing fails.
  5. 05

    Progress and final QA

    Responsibility
    Stream authenticated progress and present artifact, provenance, rights, and quality checks for final review.
    Boundary
    Cursor-based events deduplicate after reconnect, and required QA gates block the final approval transition.
    Failure path
    Resume the event stream from its cursor and withhold final approval until blocking checks are resolved.
decision-authority.ledger
02

Decisions and authority

The important choices are explicit: what the system optimizes, what it refuses to improvise, and where people retain control.

  1. 01

    Constraint

    A single generate action obscures creative choices, evidence gaps, cost changes, and rights decisions.

    Decision

    Split production into Idea, research-backed Plan, Generate/Edit, and final-review stages with explicit gates.

    Operators can inspect and change consequential state before expensive or irreversible transitions.

    Trade-off

    The workflow takes more interactions than an opaque one-shot generation path.

  2. 02

    Constraint

    Media-provider work can consume more credits than an operator expects as a project evolves.

    Decision

    Show preflight credit quotes, enforce stage ceilings, and require explicit approval for extensions.

    Spend authority stays with the operator while code enforces the approved limit.

    Trade-off

    Generation pauses when estimates change, even if the next creative step is otherwise ready.

  3. 03

    Constraint

    Claims and media become difficult to audit after repeated research, generation, and revision passes.

    Decision

    Carry source metadata and hashes into versioned artifact lineage across the workflow.

    A reviewer can trace a claim or artifact back to the evidence and inputs that produced its version.

    Trade-off

    Lineage records add metadata and lifecycle management to every production stage.

  4. 04

    Constraint

    Large browser uploads need responsive hashing without exposing storage or provider credentials.

    Decision

    Hash files in a Web Worker, use short-lived signed uploads, and keep service tokens behind the server boundary.

    The browser handles file work directly while receiving only the minimum upload capability it needs.

    Trade-off

    Signed-upload expiry and hash verification introduce additional recoverable states in the interface.

capability-stack.inventory
03

Capability and stack

Capabilities describe the work the system can perform. The stack notes explain why each technical layer is present.

Enabled capabilities

  • Structured briefs and assets carried through Idea, Plan, Generate/Edit, and review
  • Concept selection, questions, approval, revision, cancellation, and backtracking controls
  • Source-linked claims with excerpts, confidence, risk, hashes, and versioned artifact lineage
  • Preflight credit quotes, stage ceilings, and explicit spend extensions
  • Authenticated cursor-based SSE with deduplication and reconnect behavior
  • Browser-worker file hashing and signed object-storage uploads
  • Synthetic-avatar provenance, rights, consent, and final QA gates
  • Strict server-only boundaries for provider tokens and authentication

Stack rationale

  • Product

    Present the staged production workspace, operator decisions, revisions, and artifact review in the browser.

    React 19 · TanStack Start · TanStack Router · TypeScript · Vite · Bun · Tailwind CSS 4

  • Platform

    Run the backend-for-frontend, proxy authenticated access, and store signed-upload media artifacts.

    Cloudflare Workers · Better Auth · R2

  • Contracts and operations

    Validate workflow payloads, stream durable progress, and observe browser and service failures.

    Zod · SSE · Sentry

  • Verification

    Exercise web and backend-for-frontend contracts, safety boundaries, and production-stage lifecycle controls.

    Vitest · Playwright

safeguards-recovery.runbook
04

Safeguards and recovery

Reliable behavior includes the unhappy path: how faults are detected, contained, retried, or handed back to an operator.

Failure runbook

  1. 01
    Condition
    An authenticated progress stream disconnects during long-running generation.
    Detection
    The browser observes a dropped stream and retains its last accepted event cursor.
    Response
    Reconnect from the cursor, deduplicate repeated events, and continue rendering the durable workflow state.
  2. 02
    Condition
    Authentication or the backend-for-frontend token path is unavailable.
    Detection
    Protected requests fail their server-side session or proxy checks.
    Response
    Fail closed, return a sanitized error, and never fall back to a browser-visible provider credential.
  3. 03
    Condition
    A requested generation stage would exceed its approved credit ceiling.
    Detection
    The preflight quote is compared with the stage budget before provider work starts.
    Response
    Interrupt the workflow and require an explicit spend extension or a revised production choice.
  4. 04
    Condition
    Synthetic-avatar provenance, rights, or consent is missing.
    Detection
    The rights gate checks required provenance and operator confirmations before the transition.
    Response
    Block generation or final approval until the missing rights record is supplied or the asset is removed.

Principles in practice

  • Start with the workflow

    Idea, research-backed Plan, Generate/Edit, and final review form explicit stages with revision and backtracking paths.

  • Show the sources

    Claims retain source, excerpt, confidence, risk, and hash metadata through versioned artifact lineage.

  • Put rules in code

    Code owns schemas, credit ceilings, upload authorization, hashes, rights checks, artifact transitions, and final QA gates.

  • Keep people in charge

    Operators choose concepts, answer questions, approve spend and rights, revise or cancel work, and grant final approval.

  • Limit access by default

    Authenticated proxy routes and signed uploads keep provider and storage credentials outside the browser.

  • Plan for things to go wrong

    Cursor-based SSE, event deduplication, reconnect behavior, and versioned artifacts preserve long-running progress.

validation-evidence.report

// validation signal

What was checked—and what was not.

End-to-end coverage exercises authentication outages, token leakage, API keys, uploads, SSE recovery, budgets, avatar rights, and artifact lifecycle controls.

The audit covered the web and backend-for-frontend boundary, not downstream model providers or generated-media quality.

Method

Vitest and Playwright cover the audited browser and backend-for-frontend boundary through unit, integration, and end-to-end scenarios.

Checks performed

  • Authentication outages fail closed without provider-token leakage
  • API-key boundaries, file hashing, signed uploads, and artifact lifecycle remain enforced
  • Cursor reconnect, event deduplication, and long-running SSE state recover correctly
  • Budget extensions, avatar rights, consent, provenance, and final QA gates block unsafe transitions

Outside this claim

  • The audit did not establish downstream provider reliability, model quality, or generated-media quality.
  • The recorded checks do not establish production traffic scale or business outcomes.
next-system.request

// from difficult workflow to working product

Have a workflow like this?

We can help define the product, decide where AI adds value, and take it through a tested implementation.