Santara

Certificate AIN-OMS-2026-0001

Santara is certified AI-Native Operations Management Software.

Seven of nine criteria met; two met in part, both in the open. Santara's day runs without being asked, writes prices to live channels under enforced floors and ceilings, and keeps working with inference switched off. What it has not finished is publishing the limits it already enforces, and turning the operator responses it already stores into something that changes the next run.

Status
Certified
Standard
The AI-Native Standard v1.0
Grades
7 of 9 met
Issued
21 August 2026
Valid to
21 August 2028
Re-attested
21 August 2027
AI-NativeOMS · CertifiedAIN-OMS-2026-0001

Disclosure

Santara authors this standard and holds this certificate. Every grade below is published with the artefact it rests on, including the two criteria Santara did not fully meet, so the assessment can be argued with rather than taken on trust.

Scope of assessment

Santara short-term-rental OMS: the Morning Brief pipeline, the smart-pricing engine, the guest-attention and upsell detectors, and the in-product assistant. Assessed against the production build of 21 August 2026.

Standard authored and assessed by Santara. Independent assessment opens with v1.1.

Open conditions

Carried on the certificate with a date. Missing one moves the certificate to provisional at the next re-attestation.

  • C6 · Bounded and audited action

    Publish the autonomous-action inventory — every class of write, its enforced limit, its owner and its reversal path — as a public page linked from the certificate and from /security/.

    Due 21 November 2026

  • C8 · Closed feedback loop

    Feed acceptance and dismissal rates per insight type into brief ranking and detector thresholds, and publish a measured before-and-after on a real cohort.

    Due 21 February 2027

The assessment

Every criterion, and what the grade rests on

I

Autonomy

C1

Unprompted operation

Met

The system does its work on its own schedule, not on the operator's prompt.

The Morning Brief is generated hourly per tenant on a scheduled state machine in the customer's own timezone, and reaches the operator by email and push without a session. Runs are recorded in engine_runs with their trigger payload, response and heartbeat, so a fortnight of unattended runs can be read back rather than asserted.

C2

Decision-first surface

Met

The system's primary output is a decision, not a dashboard.

The default surface is the brief, not the dashboard: one sheet naming what needs attention, what it is worth, and the cleaning that has to happen, each line carrying an action label and a destination (daily_report_items.action_label / action_url) and ordered by severity and sort order rather than by recency.

C3

Write authority

Met

The system changes the world, not only the screen.

Smart pricing writes nightly rates through Channex to Airbnb and Booking.com; availability writes are clamped to the channel's own room count before they leave; turnover tasks and assignments are written to the operations board. Each night written is recorded in smart_pricing_days with its outcome — applied, would_apply, needs_approval, skipped_manual or unchanged — and the previous rate it replaced.

II

Accountability

C4

Traceable grounding

Met

Every figure the system states traces to a record it can name.

Generated items carry lineage, not prose: ai_insights.source_data holds the rows an insight was derived from, and every brief line links to the property, reservation or task it concerns. Prices are reconstructable rather than reported — smart_pricing_days stores the whole multiplier stack for a night (base, season, day-of-week, event, pace, gap, last-minute) alongside the floor and ceiling that clamped it.

C5

Legible reasoning and override

Met

It says why, where the decision is made, and it can be overruled there.

The reason travels with the decision: the brief shows the multiplier chain behind a night's price where the operator sees the price, and each insight carries its recommended action and confidence. Overrides are honoured structurally — a rate whose price_source is manual is skipped by the engine and counted as skipped_manual, and a dismissed guest does not return to the attention queue until a new signal arrives.

C6

Bounded and audited action

Met in part

Every autonomous action has a published limit, an audit record and a named owner.

The enforcement is real and the audit is real: pricing_guardrails holds per-property floors, ceilings, maximum daily and weekly movement, an auto-apply switch and an approval threshold; incomplete cost inputs raise costs_incomplete and fall back to a ratio floor rather than pricing against a cost of zero; withheld runs are recorded with the reason. What is missing is the third leg — there is no public statement a customer can read before switching the system on that says what Santara may do unattended and within which bounds.

Remediation · due 21 November 2026

Publish the autonomous-action inventory — every class of write, its enforced limit, its owner and its reversal path — as a public page linked from the certificate and from /security/.

III

Resilience

C7

Deterministic fallback

Met

With the model switched off, the system still produces a correct, safe result.

The engine that moves money is deterministic by construction: smart pricing is a multiplicative rule stack over data rows, with no model in the path, and upsell detection defaults to calendar-driven rules rather than inference. With inference unavailable the brief still assembles from operational state — arrivals, departures, cleaning, revenue, gaps — and loses only the written insight layer.

C8

Closed feedback loop

Met in part

What the operator does with the output changes the output.

Operator response is captured and partly acted on: insight status moves through acknowledged, resolved and dismissed; a dismissed guest is suppressed from the attention queue until a newer priority message arrives; a manually priced night is left alone on every later run. What does not yet exist is a loop that learns — nothing in acceptance or dismissal rates changes ranking, thresholds or which detectors fire.

Remediation · due 21 February 2027

Feed acceptance and dismissal rates per insight type into brief ranking and detector thresholds, and publish a measured before-and-after on a real cohort.

C9

Critical-path dependence

Met

Remove the AI and the product stops being the product.

Inference sits on the promise, not beside it. Santara is sold as the system that hands an operator their day; remove the generated brief, the insight layer and the assistant and what remains is a channel-connected calendar — a category the company explicitly does not compete in. The AI is not a tier: it is on every plan, and there is no version of the product sold without it.

Certification is a claim someone can check.

If a grade above does not match what the product does, the evidence named in the finding is where to start. Corrections are published against the certificate, not applied to it quietly.

Certificate AIN-OMS-2026-0001 · standard v1.0 · issued 21 August 2026