Building agentic systems with clear limits.
My current work at SMAARiX is about giving agents useful work within explicit limits. In hiring, that starts with separating what an agent may propose from what it’s authorised to execute.
Hiring turns out to be a good place to have that argument, because the decisions are consequential and the reasoning behind them gets contested more often than in most domains. Version 1.5 of Singapore’s agentic AI framework carries a recruitment case study, submitted by another company, built on the principle that the consequential calls stay with human recruiters and hiring managers. I didn’t need the framework to reach that design, but it’s useful to be able to point at someone else reaching it too.
What’s running
An agentic hiring platform. Copilots operate on the candidate records they’re permitted to operate on, and take a bounded set of actions. The permission model is the part worth describing: each action a copilot can take is either granted explicitly or isn’t grantable at all. There is no middle category that quietly widens with use.
A durable memory plane, which I use daily and wouldn’t yet call finished. Control and knowledge are kept apart. Markdown and Git hold the authority, and the search index is a rebuildable cache. Agents read the record; writing to it takes an authority the agent doesn’t hold.
How I check the mechanisms
Every mechanism in the platform is registered with two proofs: a test that asserts the live call site rather than the internals, and evidence that the mechanism actually fired after deployment. A guardrail fails the build when either reference stops existing. The rule behind it is blunt, and deliberately so. A mechanism absent from that ledger does not officially exist.
Anything that can’t yet prove itself carries a visible marker naming exactly what is owed, and the gate prints those loudly on every run.
Every figure in the briefing pack is generated from source at build time rather than maintained by hand. Under a deadline nobody re-derives numbers, and the document quietly ends up asserting figures the code stopped supporting. Generating them removes manual transcription as a failure mode. It doesn’t remove the others: the inputs still have to be current, the extraction logic still has to be right, and the output still has to be checked against the release it claims to describe.
A gate can report green even when its mechanism no longer fires. The ledger records finding and fixing that.
This is the settlement-system instinct pointed back at my own engineering. A claim without a record isn’t a claim.
Where the pattern travels
Hiring is where I’m making the argument, not the boundary of it. The company publishes three other workflows as capability demonstrations rather than engagements — organic agriculture traceability, maintenance prioritisation for renewable generation, and pharmaceutical batch reconciliation — and the reason they sit on the same page is stated plainly there:
Agriculture, renewable generation and pharmaceutical records share little vocabulary. They can still use the same decision boundary.
That is the whole claim. A certification chain, an asset alert and a batch record have nothing in common as data. What they share is the shape of the decision: evidence is gathered, an exception surfaces, a named person decides, and the trace is kept. What changes between them is what counts as evidence and who is competent to approve it. What doesn’t change is that somebody has to be able to answer for the outcome afterwards.
So the portable skill isn’t a sector. It’s the decision boundary itself, the point where the machine stops and a person signs, and I’ve been drawing that line since a settlement system where a one-cent discrepancy was an incident rather than a defect.
Keeping the runtime replaceable
The runtime that drives the agents isn’t welded into the platform. The backend doesn’t import it. One seam sits between them, and a different runtime can be put on the far side of that seam without the platform being rewritten. Which model runs is a configuration value, not an architectural commitment.
That isn’t a prediction about which tools will win. It’s the opposite: an admission that I don’t know, written into the structure so that being wrong costs a swap instead of a rebuild. The parts of this field with the shortest half-life are the ones I have made cheapest to replace.
What’s next
Cross-agent handoff: passing work between agents without losing either the thread or the authority to act. In progress, and not yet something I would describe as proven.
Source
The recruitment case study is in IMDA, Model AI Governance Framework for Agentic AI, version 1.5, published 20 May 2026 and updated 5 June 2026. It was submitted by another company. SMAARiX does not appear in the framework and has not been assessed by IMDA. Launch announcement · Framework (PDF)
Current role: CTO at SMAARiX, Singapore. This page describes the state of the work in September 2026.