Blackdown built and implemented a governed agentic workflow system for a German power trading firm. The system managed complex renewable energy transactions from start to finish, but it could not move money, transfer certificates, submit registry actions, or take market positions without approval from an authorised person.

Architecture, build & delivery

A German power trading firm

Renewables origination · Guarantees of Origin · route-to-market operations

Trading, certificate management, nominations, settlement and governance

Agent orchestration with deterministic tools and human-in-the-loop approval

2025, to production

A typical request was kept intentionally simple:

In reality, that simple instruction starts a series of regulated and financially sensitive steps: contract interpretation, certificate sourcing, GoO matching, registry redemption, commercial pricing, nominations, balancing, settlement, and audit checks.

The main design question was not whether a language model could help. Instead, it was:

A single PPA-and-GoO transaction covers several business areas, each with its own data, systems, and possible failure points. The risks go beyond inefficiency: poorly managed workflows can lead to financial losses, misallocated certificates, inaccurate green claims, settlement errors, non-compliance, or unauthorised trading.

Extracting volume, delivery profile, GoO matching rules, optionality, penalties and settlement terms from long-form agreements.

Matching demand to certificate supply across technology, geography, vintage, delivery period and registry constraints.

Structuring offers against forward curves, shape risk, imbalance assumptions, certificate availability and GoO market pricing.

Preparing nominations, bidding assumptions, metering inputs, imbalance exposure and settlement workflows.

Maintaining a reconstructable record of who approved what, when, using which source data, and on what basis.

Before orchestration, the process depended mostly on email, with commercial, legal, operations, settlement, and registry specialists each holding their own piece of the information. The system turned that fragmented process into a governed workflow — without handing business-critical calculations or external submissions to the LLM.

Blackdown designed, built and delivered the production agentic workflow — the orchestration model, tool boundaries, approval controls and audit processes used in live operations. The goal was to support complex renewable energy operations while keeping the control standards a trading environment demands.

Broke the high-level PPA-and-GoO request into auditable business capabilities and operational steps.

Defined specialist agents for contract intelligence, GoO portfolio matching, deal/pricing support and route-to-market operations.

Designed the planner/router pattern that decomposes requests, routes tasks and manages workflow state.

Introduced the human approval gate for any action involving money movement, certificate transfer, market exposure or external submission.

Separated LLM reasoning from deterministic execution so calculations, registry actions, position updates and settlement logic stayed testable.

Designed the traceability pattern across source data, agent outputs, tool calls, approvals and final actions.

Mapped integration boundaries to market data, registry APIs, metering, operational stores, document systems and settlement processes.

The architecture separated reasoning, execution and approval into distinct layers. The orchestration layer acted as both planner and router: it interpreted requests, broke them into auditable sub-tasks, and assigned each to the right specialist agent.

Specialist agents decided the next steps, but they did not directly change trading systems, transfer certificates, create external submissions, or perform settlement calculations. Deterministic tools handled those actions through set interfaces, validation rules, access controls, and audit logs. Any financially or legally binding action required approval from a designated person before reaching an external system, market process, or registry.

The system did not use a language model for business logic such as position updates, certificate transfers, or settlement calculations. These were handled in the tool layer, where they could be tested, monitored, controlled, and audited — making the architecture strong enough for real trading operations, not just a proof of concept.

Reads and monitors PPA and GoO terms: delivery period, contracted volume, eligibility, penalties, optionality and settlement terms.

Matches demand to certificate inventory across technology, country, vintage and registry constraints.

Supports commercial structuring against curves, margin, shape risk, imbalance assumptions and certificate cost.

Prepares nominations, bidding assumptions, imbalance analysis and settlement workflows.

Each agent was built to decide the next step, while deterministic tools carried out the action — avoiding the common failure where one model handles both reasoning and execution, an unacceptable control weakness in trading.

Delivery window, volume profile, GoO eligibility, matching rules, penalties, settlement terms.

Matched / unmatched MWh by technology, country, vintage and registry.

Indicative price, curve assumptions, margin, risk adjustments, GoO cost.

Nomination schedule, balancing assumptions, metering requirements, settlement workflow.

Human review before any external, financial or legally binding action.

Registry / market / ERP / settlement action, only through approved deterministic interfaces after sign-off.

Trace log, approval ID, timestamp, source data, decision record, action outcome.

At every stage, the system surfaced its interpretation, uncertainties, source data, proposed actions, and approval requirements — because a silent or unchecked error in trading can be very costly.

This was a strict rule, not a preference. The project carried significant legal and governance requirements, so there was always at least one human check of the AI’s output before any binding action. The goal was not to remove human responsibility, but to make the review step clear, informed, and easy to audit.

Human approval required before any registry action.

Contract, eligibility and inventory checks before execution.

Approval required before any bid, trade or market submission.

Assumptions surfaced for review; deterministic calculations owned by controlled tools.

Traceable link from source data to decision, approval and action.

Immutable action-and-approval log, reconstructable on demand.

Deterministic tools own calculations and state changes, not the LLM.

Identity and access controls applied at tool and action level, not just at the chat interface.

The figures below come from production data during the final two-week handover, when the system managed hundreds of live processes.

Time from request triage to a review-ready action plan — about a 92% reduction. (Production data, final two-week handover.)

Live processes handled during the two-week handover. (Production telemetry.)

Binding actions routed through human approval. (Mandatory legal and governance control.)

Beyond the measured results, the architecture delivered:

People shifted from routine coordination to focused review and approval. The reduction depended on deal type — GoO matching was simpler than a full PPA, which needed more coordination across commercial, legal, operations and settlement teams.

Interpretation, assumptions, source data, proposed actions and approval status were shown at every step.

Requests, agent outputs, tool calls, approvals and actions were all recorded in a central trace log.

Deterministic rules stayed in controlled tools rather than being hidden inside model prompts.

Because the agents matched business capabilities, the same orchestration core could support similar transaction types without a system redesign.

PPAs, GoO agreements, REGOs, tolling agreements, supply and structured energy contracts.

GoOs, REGOs, green claims, certificate inventory, customer demand and compliance reporting.

Corporate PPAs, structured renewable offers, GoO-linked products and route-to-market pricing.

Nominations, bidding, imbalance analysis, metering workflows and settlement preparation.

Compliance reviews, approval workflows, model governance and operational traceability.

The result was a reusable operating pattern for intelligent assistance across renewable energy workflows — not a one-off automation.

Energy trading workflows are not fit for unchecked autonomy. A model that can read contracts, suggest hedges, find matching certificates or prepare nominations is valuable — but if that same model can move funds, submit bids or transfer certificates without approval, it brings unacceptable risk.

This architecture solved that by using the LLM for reasoning and orchestration, never as the system of record or execution engine. It broke complex transactions into auditable tasks, routed them to specialist agents, kept LLM reasoning separate from deterministic execution, and required human approval for every binding action. During the handover it cut per-request triage from about four hours to around twenty minutes while handling hundreds of live processes — with the control standards a trading environment demands built in from the start, not added later.