How it works · engineering · live pipeline

One engineering firm's morning, run through Counsel.

Seven emails land before 9am. Three are scams. Watch the back office screen, score, route and file every one — and update what it knows.

Everything below — every fraud verdict, signal and triage decision — is the actual output of the CounselAgent pipeline run on this sample inbox. Not a mock-up. Re-run it with node demo-eng.js.

01 · The Vault — the brain

Before any email arrives, Counsel knows what's live.

Three engineering projects, each with its current situation on file. This context is what makes everything downstream sharp — the same email scores differently depending on what's live.

Helix Tower

lead · Daniel Hughes
Structural & façade engineering
What's liveLive cladding remediation under Building Safety Regulator scrutiny.

Northern Arc Rail

lead · Priya Nair
Civil & rail infrastructure engineering
What's liveJuly blockade possession dates being confirmed and on the critical path.

Meridian Data Centre

lead · Marcus Webb
MEP & structural engineering
What's liveGrid-connection conditions just issued by the DNO and feeding the programme.
02 · The inbox — the senses

The morning's mail lands.

Seven messages. To a person they all look plausible — drawings to review, a payment update, a deadline, a webinar. Counsel screens every one at the door before anybody opens them.

Helix Tower — updated GA & CDM drawings shared with you
Dropbox <no-reply@dropbox-share-secure.net>
scam
Northern Arc Rail — updated bank details for July valuation payment
Brian Walsh — Kerb & Groundworks Ltd <accounts@kerb-groundworks.co.uk>
scam
Meridian Data Centre — document library access request
Microsoft SharePoint <no-reply@sharepoint-docs-login.com>
scam
Helix Tower — EWS1 sign-off deadline brought forward to Friday
Sarah Okonkwo <s.okonkwo@maypole-developments.co.uk>
legit
Northern Arc Rail — July blockade possession dates confirmed
Tom Reilly — Network Rail <t.reilly@networkrail.co.uk>
legit
Meridian Data Centre — grid connection conditions issued
Anita Bose — Northern Powergrid <anita.bose@northernpowergrid.co.uk>
legit
Free CPD webinar: low-carbon concrete — register now
Built Environment CPD <events@built-env-cpd.com>
noise
03 · Fraud check — the guard

Scams caught at the door.

Every inbound is screened — deterministic rules plus an AI verdict — before anyone opens it. The contextually-plausible impersonations and the payment-redirection attempt never reach the team. A guard that runs quietly in the background.

3 quarantined · 4 passed to triage · 0 reached the team
⚠ HIGH-RISK · quarantinedHelix Tower
Helix Tower — updated GA & CDM drawings shared with you
Dropbox <no-reply@dropbox-share-secure.net>
  • criticaldisplay brand mismatch — Display name says "Dropbox" but the sender domain is "dropbox-share-secure.net", not the official dropbox domain (dropbox.com).
  • highlookalike domain — Sender domain "dropbox-share-secure.net" looks like a lookalike of dropbox (real: dropbox.com).
⚠ HIGH-RISK · quarantinedNorthern Arc Rail
Northern Arc Rail — updated bank details for July valuation payment
Brian Walsh — Kerb & Groundworks Ltd <accounts@kerb-groundworks.co.uk>
  • mediumreplyto mismatch — Reply-To address (kerb.payments2026@gmail.com) uses a different domain to From (accounts@kerb-groundworks.co.uk).
  • mediumurl shortener — Link uses a URL shortener (bit.ly) — true destination is hidden.
+ 1 more quarantined — same treatment.
04 · Triage — the staff

The real mail, scored against what's live and routed.

Only the safe mail reaches triage. Each message is scored against its project's live situation, given a recommended posture, and routed to the right person. The scams are never triaged; the noise is dropped for free.

Helix TowerDeadline
Helix Tower — EWS1 sign-off deadline brought forward to Friday
Sarah Okonkwo <s.okonkwo@maypole-developments.co.uk>
Impact5/5
RouteCrisis team
A contact at Maypole Developments is advising that the BSR gateway review has been brought forward and is requesting confirmation by Friday 5pm that the PAS 9980 façade fire assessment is complete and the EWS1 can be signed, in order to protect the Cladding Safety Scheme funding milestone.
Suggested postureThis message touches the EWS1 sign-off and BSR gateway directly, both of which are on the critical path — treat as urgent; the account lead should escalate immediately to the project and legal team to establish whether the PAS 9980 assessment is complete and what can be confirmed by Friday, and a holding response should be sent to Okonkwo today acknowledging receipt whilst that position is established, noting that no prior relationship with this contact exists and her authority and role in the programme should be verified before any substantive confirmation is given.
Northern Arc RailAction required
Northern Arc Rail — July blockade possession dates confirmed
Tom Reilly — Network Rail <t.reilly@networkrail.co.uk>
Impact5/5
RouteAccount lead
Network Rail has confirmed the July blockade possession dates as 12–15 July and is requesting programme alignment plus CDM coordination and safe system of work confirmation for the structures package.
Suggested postureRespond promptly and formally, as this directly advances the critical-path possession confirmation; ensure the programme lead and CDM coordinator are looped in immediately to provide the requested alignments and safe system of work sign-off — do not treat as routine correspondence given the stage gate pressure.
Meridian Data CentreAction required
Meridian Data Centre — grid connection conditions issued
Anita Bose — Northern Powergrid <anita.bose@northernpowergrid.co.uk>
Impact5/5
RouteAccount lead
Northern Powergrid has formally issued the DNO grid connection conditions, including agreed export capacity and required reinforcement works, and is asking Meridian to review these against the energisation programme and flag any date constraints.
Suggested postureTreat as urgent and substantive — this is a live operational communication directly from the DNO touching the grid connection conditions already flagged as high-impact; route to the account lead immediately so the programme team and client can assess any constraints on the energisation date before responding to Northern Powergrid.
— 1 message filtered as noise (the CPD webinar) — no client mentioned, so no AI call. The cost guard.
— 3 scams quarantined upstream — never triaged, never allowed to enrich a project.
05 · Morning report → back into the vault

Everything it learned, written back.

The high-impact items become private signals woven into each project's morning brief — and the whole lot is written back into the knowledge vault, so tomorrow the brain is current. The loop closes.

Helix TowerA contact at Maypole Developments is advising that the BSR gateway review has been brought forward and is requesting confirmation by Friday 5pm that the PAS 9980 façade fire assessment is complete and the EWS1 can be signed, in order to protect the Cladding Safety Scheme funding milestone.
Northern Arc RailNetwork Rail" <t.reilly@networkrail.co.uk> — Network Rail has confirmed the July blockade possession dates as 12–15 July and is requesting programme alignment plus CDM coordination and safe system of work confirmation for the structures package.
Meridian Data CentreNorthern Powergrid" <anita.bose@northernpowergrid.co.uk> — Northern Powergrid has formally issued the DNO grid connection conditions, including agreed export capacity and required reinforcement works, and is asking Meridian to review these against the energisation programme and flag any date constraints.
Open the live console → Back to the landing