Systems I run
These are the controls behind my day-to-day agent work: what an agent can do, what it has to prove, and who remains accountable.
They run on my own machines, on real work, every day. This isn’t a proposal.
Why the controls matter
An agent that can act is a delegation problem before it is a technology problem.
Once software can make a lasting change, three things matter: who authorised it, what evidence supported it, and whether the decision can be reconstructed later.
- Authority
- Identify who authorised the change.
- Evidence
- Keep the basis for that authorisation.
- Reconstruction
- Be able to show how the decision happened.
The rule underneath everything is simple:
No entity may silently take another entity’s authority.
Everything else follows from that.
How it works
The control plane — method and authority
The control plane defines what can happen, within what boundaries, and what has to be proved.
Agents get the evidence and authority needed for the task, then act within that scope and verify the result. Important actions (deployment, production access, data changes, security exceptions and irreversible decisions) stay behind explicit owner gates.
Confidence never substitutes for authority.
The memory plane — read, but not quietly rewrite
The durable record sits in its own plane. Agents retrieve from it as they work, but every durable write needs authority the agent does not hold, so reading history never becomes permission to change it.
The continuity plane — handoff with receipts
Requests, receipts and evidence travel with every handoff between sessions, machines and agents, so the record behind the work survives the move.
The advice boundary — typed answers, never authority
The newest piece is an advisory decision layer, built and tested but not yet wired to any model. It is not one of the controls that run yet.
An agent may ask a bounded question about a piece of work and get back a typed answer: one of the declared options, a yes or no, a probability, an expected position on a scale, or a distribution. Every answer carries an outcome from a closed set, only an answer that was actually evaluated carries a value, and abstention is explicit. Each question gets one attempt, with no retries, and nothing a provider or a caller wrote is echoed back into a log.
Before any provider binds, it passes one conformance suite, and that suite is proved by the variants it rejects: one that truncates, one that retries past its budget, one that quietly falls back to a second provider, one that leaks a planted secret.
It is off by default, and turning it on permits advice to be considered without making anything true. The rules it enforces start with advice never becoming authority.
When the system says no
The distinction I care about is simple:
A guideline asks. A control refuses.
The limits are designed to hold even when they are inconvenient. I know because they have stopped my own work when it exceeded them.
That is the point. A boundary you can cross whenever it gets in the way was never really a boundary.
The same principle applies throughout: capabilities can be removed, missing dependencies fail honestly, and external providers never become the source of authority.
What stays private
The working instances stay private: journals, decision records, failure logs, machine topology and configuration.
What transfers is the thinking behind them: the contracts, schemas, protocols and reasoning.
The private implementation proves the approach. The reusable value is the specification.
I publish that specification as references: agentic-approval-gates, ai-memory-reference, agent-checkpoint-contract and agent-handoff-pattern.