Agentic supplier risk for rail· Project sponsor: Siemens Mobility · Nebius Build Week × NVIDIA · Berlin 2026

SupplyGuard

One question. A supervisor and four specialist agents. A workspace that builds itself for your role.

10,000

rail suppliers, 18 risk factors each

911

hidden risks: rated Low/Medium overall, Critical on one factor

€20.4B

annual purchase-order volume in the portfolio

€10.3B

risk-weighted exposure (spend × risk index)

NVIDIA Nemotron Nebius Token Factory Nebius Cloud Tavily FastAPI · React · d3

01The problem

Procurement teams see a score. They don't see why, or what changed this morning.

911

Headline scores hide risk

Suppliers rated Low or Medium overall carry a Critical sub-score: finances, quality, compliance. A single total averages the danger away.

4+

Signals are scattered

Audit PDFs, scanned certificates, supplier emails about delays, news on strikes and commodity prices. Each lives in a different place, and nobody connects them to the risk score.

scanned PDFssupplier emailsnews & marketsdataset

5

One dashboard fits nobody

The risk manager, strategic buyer, CFO, ESG officer and maintenance engineer ask different questions of the same data. Static dashboards serve none of them well.

RiskBuyerCFOESGEngineer

02How we solve it

Ask in plain language. Agents gather the evidence. Exact maths does the numbers. You approve.

1

Ask

Describe a procurement request in chat, upload an item list as a PDF, or let an incoming supplier email trigger it.

React · SSE

2

Plan

The Supervisor reads the user's role, focus and notes, then decides which sources it needs.

Nemotron 3 Super

3

Fan out

One delegate call starts the Data, Document, Email and Web agents in parallel threads.

4 agents · parallel

4

Ground

Agents call tools: exact risk maths, OCR'd documents, the email connector and Tavily search. Every claim gets a citation.

Tavily

5

Compose & act

A role-specific workspace and answer, with recommended actions that wait for a human to approve them.

Generated UI

03System architecture

One supervisor, four specialists, all on open models.

04Agent orchestration

Every agent step streams to the UI as it happens.

# agents.py: one generic tool-calling loop def _loop(agent, system, task, tools, model): for _ in range(MAX_STEPS): # max 6 msg = chat(model, msgs, tools) if not msg.tool_calls: emit(agent, "answer", msg.content) return # tool calls run in parallel threads emit(agent, "tool_call", ...) emit(agent, "tool_result", ...) # Supervisor gets ONE tool: delegate delegate(data_task, document_task, email_task, web_task) → ThreadPoolExecutor → 4 × _loop

OpenAI tool-calling schema SSE: plan · tool_call · tool_result · answer thinking off for speed

Q Which brake suppliers should I worry about this week? · Risk Manager

SupervisorplanSources available: data, email, docs, web

Supervisortool_call→ delegate(data_task, document_task, email_task, web_task)

Datatool_call→ rank_suppliers({"sort_by":"exposure","level":"High","n":10})

Documenttool_call→ search_documents({"query":"brake audit finding"})

Emailtool_call→ list_inbox({"unread_only":true})

Webtool_call→ web_search({"query":"railway brake supplier disruption","topic":"news"})

Datatool_call→ get_supplier({"supplier_id":"SUPP_09733"})

Emailtool_call→ assess_delay({"supplier_id":"SUPP_01703","delay_weeks":6})

DocumentanswerAudit cites cash-flow pressure… [doc: audit_report.pdf]

Webanswer2 contextual signals with sources [web: url]

DataanswerTop exposures, score breakdown, alternatives [data]

EmailanswerRisk 15 → 21, line stop 2 weeks [email: URGENT…]

SupervisoranswerBottom line + evidence table + actions (need approval)

Example trace, in the exact event format the Copilot page renders.

05Data agent · database calls

The LLM picks the tool. The tool does the maths. No guessing.

portfolio_overview

Spend, levels, hidden risks, exposure

rank_suppliers

Top-N by exposure, delivery, ESG…

get_supplier

Full profile + points per factor

compare_suppliers

2–6 suppliers side by side

what_if

Recompute risk if sub-scores change

find_alternatives

Lower-risk suppliers, same category

risk_history

24-month trend SIMULATED

fleet_impact

Fleets, lead time vs safety stock SIMULATED

Data layer

Supplier dataset
10,000 rows × 46 columns, loaded once into pandas, with derived exposure, hidden-risk and priority flags

Enrichment SIMULATED
Country, part category, IRIS certification, fleet BOM, lead times, PO ledger

App stores
Personas, buyer notes, saved procurement projects, extraction cache

REVERSE-ENGINEERED SCORE

Total = round( Σ w_i · s_i )

Least-squares fit over all 10,000 suppliers: RMSE 0.29, which is integer rounding. Every point of every score is traceable.

0.10

Operational · Financial · Quality

0.08

Compliance

0.06

Credit · Safety · Sub-tier

0.05

Geopolitical · Governance · ESG

0.04

Env · Labor · Digital · Political · Bench

0.03

Market · Media · Ext. intel

Hidden risk = total < 50 and any factor ≥ 75
Exposure = PO volume × total risk / 100

06Data extraction · OCR with NVIDIA Nemotron

Scanned audits and certificates become cited evidence.

01 · INPUT

Shared folder or upload

Audits, certificates, contracts, finance, quality reports, procurement requests

→

02 · ROUTE

By file type

Text, MD, CSV, DOCX read directly. PDFs with a text layer skip OCR. Scans render at 150 dpi, up to 10 pages

→

03 · OCR

Nemotron Parse

Page image sent in an <img> tag. A forced tool call (markdown_no_bbox) returns structured markdown. Nemotron VL is the fallback

→

04 · INDEX

Cache & chunk

SHA-1 file hash cache, so each file is OCR'd once. 1,200-char chunks with 200-char overlap

→

05 · USE

Document Agent

search_documents runs 2–3 keyword queries and quotes passages as [doc: file]

Procurement request → supplier map

Upload a request PDF. Nemotron Parse reads it, then Nemotron 3 Super extracts the items into JSON and maps each one to a rail part category. Every item becomes a bubble of qualified suppliers, coloured by risk.

nemotron-parsenemotron-3-superkeyword fallback if no LLM

// POST /api/procurement/upload → items {"project": "RegioFlex", "items": [{"item": "Brake control unit", "category": "Brake systems", "quantity": 120, "needed_by": "2027-W06"}, …], "parsed_by": "nvidia/nemotron-3-super-120b-a12b"}

07Web agent · Tavily news & market signals

Live outside-in context, with a source behind every fact.

CHALLENGE

Supplier names in the dataset are anonymised ("Elite Systems 250"), so searching by name returns nothing.

OUR APPROACH

Search by part category + country + topic. Report results as contextual signals, never as facts about a named supplier.

3 parallel queries for a brake supplier in Belgium:

railway brake systems supplier news 2026

Belgium brake systems manufacturing supply chain disruption

rail rolling stock brake systems shortage delay

TAVILY SEARCH

topic="news" · include_answer=True · up to 10 results

↓

NORMALISE · DEDUPE · CACHE

{title, url, content, published_date}. Dedupe by URL, cache by query hash

↓

USED BY

Web Agent answers cite [web: url]. The supplier deep dive shows a news feed

disruptions & strikessteel · copper · commoditiesCSDDD / LkSG regulationregional events

08Email connector · risk that updates itself

A supplier emails a delay. Risk is recomputed in seconds.

from logistics@elite-systems-250.example · SUPP_01703

URGENT: delivery delay BCU-7 brake control units (PO-2026-48113)

…deliveries of the BCU-7 brake control units under PO-2026-48113 (120 units, RegioFlex) will be delayed by approximately 6 weeks.

Root cause: a furnace failure at our casting sub-supplier. Because of current cash-flow constraints the replacement castings can only be ordered against prepayment…

Nemotron extracts → {"supplier_id": "SUPP_01703", "delay_weeks": 6, "causes": ["sub_supplier", "cash_flow"]}

→

assess_delay(): RULE-BASED SCORE CHANGES, THEN EXACT RECOMPUTE

Operational Resilience +5 per week of delay (max +30) · sub-supplier cause → Sub-Tier Visibility +15 · cash flow → Financial Health +15 · delivery −2.5 pts per week

Total risk

15→21

Delivery rating

100%→85%

Line-stop risk

2 weeks

6-week delay vs 4-week safety stock SIMULATED

Recommendable

yes→no

rule: risk < 50 and delivery ≥ 90%

REGIOFLEX · BCU-7
RECOMMENDATION ~~Elite Systems 250~~ risk 15 → Global Group 863 risk 42 SUPP_09615 · France · after buyer approval

09Generative UI · request workspace

Describe what you need. The workspace builds itself around it.

01 · INTAKE CHAT

Type the request or upload a PDF item list. Scans are read by Nemotron Parse

→

02 · NEMOTRON 3 SUPER

Extracts items as JSON and maps each to a rail part category

→

03 · CONSTRAINTS

EU only? Priority: lowest risk, delivery reliability or proven volume

→

04 · SUPPLIER TREE

Radial tree or bubbles: items → proven suppliers, coloured by risk

→

05 · RECOMMEND

Ranked only inside each item's branch. Priority adjusts the score; it never overrides risk

RegioFlex · EU only
priority: lowest risk

dot = risk · bar = PO volume
ringed = recommended

Item	Recommended (EU)	Risk	Avoid
Brake control unit BCU-7 240 units · 8 suppliers	Elite Systems 250 SUPP_01703 · Belgium · delivery 100%	15	SUPP_09733 · risk 87
Bogie frame (motor) 480 units · 8 suppliers	Elite Partners 335 SUPP_09469 · Denmark · delivery 96%	41	SUPP_06901 · risk 71
Door drive unit DDU-4 960 units · 8 suppliers	Global Group 353 SUPP_00216 · Hungary · delivery 92%	37	SUPP_00255 · risk 69

Real output of /api/procurement/bubbles on the 10,000-supplier dataset. Country is SIMULATED enrichment.

first sign-in

Nemotron also writes each persona's layout spec (title, greeting, panels, suppliers per item). The spec is checked against a whitelist and falls back to a template, and the LLM never writes code.

10Trust by design

Built for decisions people can defend in an audit.

01

No LLM arithmetic

Every figure comes from a tool: pandas, the exact score formula or rule-based what-if. The model selects and explains.

02

Cited evidence

Inline sources on every claim: [data], [doc: file], [email: subject], [web: url].

03

Honest labels

Country, category, fleets, history and orders are enrichment, labelled SIMULATED wherever they appear.

04

Human in the loop

Recommended actions are marked "need approval". Recommendations require risk < 50; the buyer's priority adjusts the ranking but never overrides risk.

05

Graceful fallbacks

Regex for emails, keyword matching for requests, a persona template for the UI. The app still works when a model call fails.

06

Bounded agents

Step caps (6 / 4 / 3 / 2 per agent), tool output capped at 12k chars, caches for OCR and Tavily, thinking off for latency.

11Partner technology

Each partner does real work in the system.

NVIDIA Nemotron

Open models drive all reasoning, tool calling and OCR

agents · UI spec · nemotron-3-super-120b-a12b

fast alternative · nemotron-3.5-lightning-30b-a3b

OCR · nemotron-parse / nemotron-parse-2.0

vision fallback · nemotron-3.5-super-vl-120b-a12b

Tool calling for the supervisor and all 4 specialists
Structured JSON for UI specs, email events and procurement items

Nebius

Inference and hosting

Token Factory: OpenAI-compatible endpoint serving Nemotron to every agent
Model picker lists Nemotron models live from the account
Nebius Cloud VM (CPU, cpu-d3) runs the app behind Caddy with automatic HTTPS
Provider switch to NVIDIA API (build.nvidia.com) for Nemotron Parse

Tavily

Live web intelligence

Web Agent tool web_search with news topic and answer synthesis
Supplier news feed: 3 parallel queries by category and country
Market context: commodity prices, regulation, regional disruption
Results cached and cited by URL

OPEN STACK FastAPIServer-Sent EventspandasPyMuPDFReact 18ViteTailwind 4d3-hierarchyRechartsMCP-style tools

From question to approved action

SupplyGuard

Hidden risks found. Evidence cited. A workspace built for each role.

Ask→ Supervisor plans→ Data Documents (OCR) Email Web (Tavily)→ Supplier tree + picks→ Human approves

FOR SIEMENS MOBILITY · BUILT WITH NVIDIA Nemotron Nebius Token Factory Nebius Cloud Tavily