I run an ecosystem of 32 AI agents — research, planning, publishing, monitoring — with real autonomy over real surfaces. Autonomy without controls is just risk with good branding. This page is the control environment that system runs under, in the vocabulary it descends from: audit.
Auditing a model is a benchmark problem. Auditing a system of agents is a controls problem — and controls are a discipline assurance has been building for decades.
First, rectify the names — 正名
正名 — the rectification of names. Asked what he would do first if given a state to govern, Confucius answered: 必也正名乎 — "It would surely be to rectify the names." If the names are not right, language does not accord with truth; when language does not accord with truth, affairs cannot be carried to success.
A system of autonomous agents is a naming problem before it is anything else. Every control on this page exists to keep one name true. A build ships only when a spec was written and independently audited. A change is not final until a human could have looked. A job is healthy only if it is actually running, and deployed only if it actually serves — so the dashboard cannot lie. A session is not complete until its closing procedure has actually run. And every item the system surfaces is labelled with where it came from — so what I decided is never quietly confused with what the machine decided.
I learned this the way you learn most controls: from the failures. A command that never existed propagated through nine configuration files over four weeks, because everyone — including the machine — kept naming it as if it were real. An agent count that read "24" in one place and "32" in another. A task written in the wrong markup that looked like a task and was counted by nothing. Each was a name that had come loose from what it named — invisible until the map was forced back onto the territory. The controls below are the mechanism that forces it. Governance, here, is 正名 with enforcement hooks. → the full argument: /zhengming
The control matrix — running, not hypothetical
Build gate
No agent, automation, or surface ships without a written spec, and no spec passes without an independent review by a dedicated auditor agent — scope, failure modes, edge cases, rollback. The gate is enforced, not honorary: a pre-action hook blocks the build if the audit hasn't happened. "It's just a small fix" is not an exemption, because the builder doesn't get to adjudicate its own scope.
Audit conceptChange-management approval — segregation of duties between the party building the change and the party approving it.
Caught in the wildThe gate has been bypassed — five straight builds in one stretch, one of them an active override — and it has had coverage holes, a whole class of builds slipping around it through a back door until the gate was widened to cover them. It earned its enforcement by first failing open. → /atlas-of-failures
Hold window
Foundational changes enter a 48-hour hold before automated processes are allowed to push over them. Nothing about the machine needs two days; the window exists so a second look can happen at human speed. The hold is honored by the automation itself — the nightly jobs check for it and stand down.
Audit conceptChange review window — a cooling-off period between commit and irreversibility.
Caught in the wildOn an unattended overnight run, changes to the system's own governing rules were held back from auto-commit and queued for a waking human — rather than pushed at 2 a.m. The window did its job by refusing to act. → /incidents
Continuous monitoring
Every scheduled job in the fleet reports into an hourly health snapshot; watchdogs watch the watchers; and alerts fire only on failure. Silence is a designed signal — if a channel speaks, something actually needs attention, so alert fatigue never gets the chance to train anyone to ignore the controls.
Audit conceptContinuous control monitoring, and management by exception — the operating posture regulators keep asking for and rarely get.
Caught in the wildA job once reported success at the step it could see — a file downloaded — while the step it could not see, the deploy that actually serves the page, had never been wired. "Green" is now defined at the delivered surface, not the first passing step. → /incidents
Enforcement hooks
Policy that lives in a document is a wish. Here, controls execute at the tool layer: hooks intercept an agent's actions before they run and block the non-compliant ones — a session cannot record its work as complete until the required closing procedure has actually run. The control produces its own evidence as a side effect of operating.
Audit conceptPreventive controls over detective ones — and evidence standards, because a control that can't show it ran might as well not exist.
Caught in the wildMid-report, a hook blocked a completion claim that had not been verified; the block forced a live re-check; the re-check surfaced a second error; and that error became a queued fix to the hook itself. Failure → enforcement → correction → a better rule, machine-mediated, in a single pass. → /incidents
Decision origin
Every item an agent surfaces carries a label naming where it came from: something I asked for, something an agent raised proactively, something self-healing fixed on its own, or something a scheduled process produced. Delegation stays legible. Attribution is the difference between delegation and abdication.
Audit conceptAccountability and audit trail — who decided, on whose authority, answerable after the fact.
Caught in the wildA phantom command that never existed spread through nine configuration files over four weeks because it kept being cited as if real. Attribution is now checked before anything is named a command — and every surfaced item carries the origin that a name alone would hide. → /atlas-of-failures
Why this exists
Agentic systems are moving into work that used to be done only by people — and the assurance profession does not yet have its playbook for them. The pieces exist: change management, monitoring, segregation of duties, evidence, accountability. What's missing is the translation layer between those concepts and systems that act on their own initiative.
This ecosystem is my working laboratory for that translation — every control above is live in a real fleet, not a slide. The failure modes are real (a gate that got bypassed taught me more than any framework), the fixes are structural, and the evidence trail exists because the controls generate it. The failures have their own pages: a field guide to how agent systems break, and the blameless postmortems behind each control above.
If you work in audit, assurance, or AI governance and this vocabulary sounds like yours — I'd like to compare notes.