Bath & Body Works, LLC OS

What are we working on?

Build governed apps, documents, and workflows with your organization's context.

Starter workspaces

Security & Resilience Command CenterAssess customer and loyalty-data protection across fragrance, body-care, and store operations.

Live App

Enterprise Technology Operating BriefShape a governed modernization plan for discover fragrances to choose products to purchase to receive or pick up to earn rewards or replenish.

Document

Responsible AI Portfolio ReviewPrioritize fragrance discovery and recommendations with evaluation, cost, and access controls.

Slide Deck

Illustrative prototype. Uses public company context and simulated data; no connection to Bath & Body Works, LLC systems.

Build a security and resilience command center for fragrance, body-care, and store operations. Map customer and loyalty-data protection, payment and commerce fraud defense, store, supplier, and third-party risk, and require human approval before any containment action.

AI

I start with no access. I'll request only the evidence needed for this workspace.

Gatekeeper: Security Operations
Read-only access to simulated posture, incident, and vendor-risk resources. Credentials remain isolated and every observed resource follows this work when shared.

Approve read-only access.

AI

Executed deterministic query

const findings = await env.SECURITY_POSTURE.listFindings({
  scope: "enterprise", window: "24h"
});
const reviews = await env.VENDOR_RISK.listReviews({
  status: "open", access: "read-only"
});
app.render(SecurityCommandCenter, { findings, reviews });

The command center is ready. Any externally visible or destructive action remains behind human approval.

Create a 90-day technology operating brief for fragrance, body-care, and store operations. Focus on consistent store and digital experience, inventory and fulfillment visibility, connected loyalty and customer data.

AI

I'll ground the brief in curated company context and public operating context.

Gatekeepers: Portfolio + Service Management
Read-only access to simulated service health, dependency, and portfolio metadata. Source permissions remain attached to the output.

AI

The brief turns the journey from Discover fragrances to Choose products to Purchase to Receive or pick up to Earn rewards or replenish into measurable jobs to be done. Repeated reporting is implemented as code; AI is used only where judgment adds value.

Create an executive AI portfolio review for Bath & Body Works, LLC. Prioritize fragrance discovery and recommendations, demand and replenishment forecasting, customer-service assistance, with model evaluation, cost, and access controls.

AI

I'll use public company context and simulated governance data only.

Gatekeepers: Model Registry + AI Gateway
Read-only access to model metadata, evaluation summaries, and aggregate spend. No prompts or credentials are exposed.

Executed deterministic query

const portfolio = await env.MODEL_REGISTRY.list({
  include: ["owner", "evals", "risk-tier"]
});
const spend = await env.AI_GATEWAY.aggregate({ by: "workspace" });
deck.render(PortfolioReview, { portfolio, spend });

AI

The review is ready. Every candidate use case has a human owner, evaluation gate, resource boundary, and cost policy.

Command center

Policy trace

Connections

Security & Resilience Command Center

Illustrative data. This interface demonstrates governed workflows and does not report Bath & Body Works, LLC security posture.

96%

Control coverage

7

Priority findings

24

Governed resources

2

Human approvals

Attention queue

Review: Payment and commerce fraud defense. An analyst must approve containment.

Monitor: Store, supplier, and third-party risk. Evidence remains bound to source permissions.

Illustrative readiness by focus area

Customer and loyalty-data protection

96%

Healthy

Payment and commerce fraud defense

81%

Monitor

Store, supplier, and third-party risk

68%

Review

Brief

Sources

Connections

Enterprise Technology Operating Brief

Illustrative planning artifact. Priorities are derived from public business context, not internal plans.

Bath & Body Works, LLC — Technology Operating Brief

90-day planning view · Draft

Purpose

Create a resilient technology operating model for fragrance, body-care, and store operations while improving the journey from discover fragrances to choose products to purchase to receive or pick up to earn rewards or replenish.

Jobs to be done

Priority	Journey moment	Required review
Consistent store and digital experience	Discover fragrances	Service owner review
Inventory and fulfillment visibility	Choose products	Architecture review
Connected loyalty and customer data	Purchase	Security review

Operating principles

Start with a measurable job to be done, not a new tool.
Use curated company context before model knowledge.
The human owner remains accountable for every output.
An agent never receives more permission than the person using it.

Gatekeepers hold credentials, scope every resource, and preserve the observation trail when work is shared.

90-day sequence

Days 1-30: map service owners and critical dependencies. Days 31-60: turn repeatable work into deterministic workflows. Days 61-90: measure outcomes, cost, resilience, and user adoption.

Control alignment

U.S. state privacy laws, Accessibility requirements, Consumer-product requirements requirements are treated as design inputs. Legal, security, privacy, finance, and operations approve externally visible actions.

Slides

Sources

Connections

Responsible AI Portfolio Review

Slide 1 of 4

Responsible AI Portfolio Review

Bath & Body Works, LLC OS · Illustrative prototype

Slide 2 of 4

Public-context opportunity areas

Use case	Stage	Human owner	Next gate
Fragrance discovery and recommendations	Candidate	Business + AI	Define evals
Demand and replenishment forecasting	Pilot	Product + Risk	Validate controls
Customer-service assistance	Scale	Operations + AI	Monitor outcomes

Candidate portfolio only; not a statement of Bath & Body Works, LLC initiatives.

Slide 3 of 4

Governance scorecard

100%

Owner assigned

92%

Evaluated pre-release

100%

Gateway routed

4

Approval gates

Illustrative target-state controls.

Slide 4 of 4

Next operating loops

Context: curate terminology, policies, and quality criteria.

Evaluation: define task-specific quality, safety, and fairness tests.

Access: bind every data resource through a Gatekeeper.

Efficiency: use code for deterministic work and models only for judgment.

Integrations

Organization-wide connections for Bath & Body Works, LLC OS. Gatekeepers hold credentials, scope resources, and log each action.

Prototype catalog. Connections and authorization states are simulated.

Gatekeepers

1

Productivity suite

Mail, calendar, documents, spreadsheets, and files

2

Collaboration

Chat, channels, meetings, and workflow notifications

3

Project tracking

Programs, epics, issues, sprints, and delivery status

4

Knowledge base

Policies, procedures, standards, and team documentation

5

Service management

IT tickets, incidents, change requests, and asset data

6

HRIS

Employee directory, organization, benefits, and lifecycle workflows

7

ERP & procurement

Finance, planning, purchasing, supply chain, and billing

8

CRM

Customer, account, partner, and service relationship data

9

Code platform

Repositories, reviews, issues, and engineering standards

10

Data platform

Governed warehouse, catalog, analytics, and reporting

11

Security operations

Alerts, cases, exposure, audit, and control evidence

12

Business intelligence

Dashboards, semantic models, and executive reporting

MCP Server Portals

Illustrative remote services available to authorized workspaces.

Security Operations

https://security.mcp.demo.example/mcp

Auto

Enterprise Data Catalog

https://data.mcp.demo.example/mcp

Needs auth

Finance & Procurement

https://finance.mcp.demo.example/mcp

Auto

People Directory

https://people.mcp.demo.example/mcp

Needs auth

Cloudflare API

https://cloudflare.mcp.demo.example/mcp

Auto

Organization Context

Shared, curated knowledge that grounds every Bath & Body Works, LLC OS workspace. Context is versioned and read-only to agents.

Public operating context: bathandbodyworks.com · Internal-looking documents below are illustrative.

md

company-strategy.md

Mission, operating model, annual priorities, and outcome definitions

md

brand-and-communications.md

Terminology, voice, accessibility, and approved communication patterns

md

security-standards.md

Identity, data protection, secure development, and incident requirements

md

responsible-ai-standard.md

AI risk tiers, evaluations, human oversight, and acceptable use

md

data-classification.md

Data categories, handling rules, retention, and sharing restrictions

md

architecture-principles.md

Technology standards, decision records, review criteria, and ownership

md

vendor-risk.md

Due diligence, contract controls, monitoring, and exit requirements

md

customer-experience.md

Journey definitions, service standards, and quality measures

md

operations-playbook.md

Service ownership, runbooks, escalation, continuity, and recovery

md

finance-controls.md

Planning, purchasing, expense, audit, and reporting procedures

md

people-policies.md

Hiring, onboarding, performance, leave, and workplace guidance

md

legal-and-compliance.md

Review paths, records, privacy, accessibility, and regulatory obligations

Skills

Reusable workflows for every function. The human requester owns the result.

Name	Description	Group	Source
meeting-prep	Build an agenda and briefing from authorized calendar, CRM, and document context	General	Shared library
weekly-operating-review	Create a cross-functional summary with decisions, owners, and open risks	General	Shared library
incident-response	Assemble evidence, draft updates, and preserve human approval for containment	Security	Shared library
vendor-risk-review	Compare due-diligence evidence with security and privacy standards	Security	Shared library
control-evidence-pack	Map authorized evidence to control requirements and identify gaps	Security	Shared library
architecture-review	Review a proposal against architecture principles and decision criteria	IT & Architecture	Shared library
change-impact	Map dependencies, affected services, stakeholders, and rollback requirements	IT & Architecture	Shared library
service-health-review	Summarize service levels, incidents, changes, and capacity risks	Operations	Shared library
runbook-builder	Turn a procedure into a deterministic workflow with approval gates	Operations	Shared library
ai-model-review	Summarize ownership, evaluations, drift, risk tier, and release readiness	Data & AI	Shared library
data-quality-report	Assess freshness, completeness, lineage, and policy compliance	Data & AI	Shared library
budget-variance	Compare actuals with plan and draft a finance-reviewed variance narrative	Finance	Shared library
procurement-brief	Summarize requirements, alternatives, risk, and approval status	Finance	Shared library
job-description	Draft an accessible role description from approved job architecture	HR	Shared library
onboarding-plan	Create a role-based onboarding plan without expanding system permissions	HR	Shared library
contract-intake	Extract terms, route issues, and prepare a legal review checklist	Legal	Shared library
privacy-assessment	Map a proposed workflow to data categories and privacy obligations	Legal	Shared library
account-brief	Create a customer briefing from authorized CRM and public information	Sales	Shared library
proposal-draft	Build a first draft using approved claims, pricing, and brand context	Sales	Shared library
executive-update	Turn project evidence into a concise decision-oriented update	General	Shared library

Profile

Illustrative account information for this public prototype.

Account

AI Gateway

Illustrative demo data. Visibility and controls across every AI provider Bath & Body Works, LLC uses — one console.

Requests

128,400

▲ 11% vs last mo

Tokens

342M

▲ 8% vs last mo

Est. spend

$9,120

76% of budget

Cache-hit

27%

▲ saves ~$2.4k

Error rate

0.6%

▼ 0.2 pts

p50 latency

480 ms

across providers

Models in Use

This month

Model	Route	Tokens	Spend	Share	p50 latency
Llama 3.3 70B	Workers AI	156M	$2,140	42%	310 ms
Claude	via AI Gateway	98M	$3,980	24%	720 ms
GPT-4o	via AI Gateway	61M	$2,510	18%	640 ms
Workers AI embeddings (bge)	Workers AI	27M	$190	16%	40 ms

Spend vs. Budget

9 days remaining

$9,120spent of $12,000 cap

76%

On track · ~$2,880 left with 9 days

Top Users

Demo User 0142M tok $1,180

Demo User 0231M tok $960

Demo User 0328M tok $840

Demo User 0422M tok $610

Usage by Workspace / Team

342M tokens total

AI Enablement

121M tokens · $3,240

Platform Engineering

89M tokens · $2,460

Customer Experience

62M tokens · $1,510

Enterprise Operations

41M tokens · $1,020

Security & Compliance

29M tokens · $890

Governance

Guardrails enforced by Gatekeepers + AI Gateway, with resource-scoped access, audit trails, and human approval.

Per-team allowed models

Restrict which providers each workspace can call.

Monthly spend caps

Hard limits per team; agents stop before overrun.

Data & AI $4,000Platform $3,000

PII redaction

Strip sensitive fields from prompts before they leave.

Enabled

Prompt / response logging

Full request logs retained for audit & review.

Enabled · 90-day retention

Rate limits

Per-team request ceilings to protect budgets.

600 req / min|burst 1,000

Raise Data & AI cap to $6,000

Change queued by an agent — needs a human sign-off.

Requires approval

What are we working on?

Bath & Body Works, LLC — Technology Operating Brief

Purpose

Jobs to be done

Operating principles

90-day sequence

Control alignment

Responsible AI Portfolio Review

Public-context opportunity areas

Governance scorecard

Next operating loops

Integrations

Organization Context

Skills

Profile

AI Gateway

Models in Use

Spend vs. Budget

Usage by Workspace / Team

Governance

Per-team allowed models

Monthly spend caps

PII redaction

Prompt / response logging

Rate limits

Raise Data & AI cap to $6,000

AI Gateway Explorer

Review spend cap change