I run a system of 37 AI agents with real autonomy over real surfaces. This page is the layer above its controls: what the system is for, what it's aiming at, the rules it runs by, who decides what, how much risk it takes on, and the risks it carries now. The controls themselves are on /controls.
Scope, stated plainly. AI drafted this system's governance, including the risk scores, and I chose what stands. Nobody has reviewed any of it independently. Each objective says whether it's met. How it was tested →
21 controls · as of 2026-09-29
1Mission
The thing I'm building is never the goal. I've always been interested in whether AI can build it, how it gets built, and how to keep it under control.
2Objectives
Each objective is a target, with the measure that would show it met and where it stands today.
Target 1 of 4
Build with AI end to end, in a way someone else can read back.
Measure
Every build on a watched path has a spec and a review on file.
Status
Not yet measured The build gate (CM-01) requires a spec or a passed review before a watched path changes. Nothing yet counts what share of builds went through it.
No irreversible or outward action without a human yes, no failure silent for more than seven days, and every control's test shown failing before the control is relied on. Tracked through the risk register, re-scored every quarter.
Status
Not met 9 of the 13 published risks sit outside tolerance after the 2026-09-29 re-score. Scheduled jobs also push to a private remote every night without a yes for each push.
These are the rules the controls come from, in short form.
01
Earned knowledge over borrowed certainty
A claim stays a claim until something has checked it, and that includes my own claims.
02
A check that can't fail isn't a check
Before a control is relied on, its test runs against a copy broken on purpose, and it has to go red.
03
A rule in a document is a wish
The rules that matter run as code outside the model, where an agent can't skip them from inside its own turn. Where a rule is still only guidance, the control register says so.
04
Fix it three times
Fix the instance, then its cause, then whatever would let it happen again, because a fix that stops at the first step tends to come back.
05
Delegation without abdication
I keep a veto, not the pen. Agents do the work, and anything they surface should say where it came from, so a machine's decision doesn't pass as mine.
06
Silence is the risk, not failure
A job is judged by what it delivered, not by its exit status, because the failure that does damage is the one that reports healthy while nothing happened.
07
Portable by design
What the system knows lives in plain files, so models, tools and interfaces can be swapped out without losing any of it.
08
Rectify the names 正名
Confucius said the first act of governing is to get the names right. Here that means shipped, done and healthy have to be true of the thing they name.
09
Challenge on logic, not on caution
Object when the reasoning is wrong or the plan won't reach its goal. A plan being unusual or risky isn't, on its own, a reason to object.
10
Less certain, fewer words
When the evidence is thin, say so in one sentence rather than covering the gap with more words.
4Roles and decision rights
Each decision right names the control that enforces it, or says that nothing does yet.
Owner
The one person the system works for.
Approves every send, publish, deploy and payment, one approval per action.
By convention, not enforced.AC-02 records the rule.
Sets the risk tolerance and accepts the risk that remains.
By convention, not enforced.GV-01 records the rule.
Sets the mission and objectives, and can veto anything an agent proposes.
By convention, not enforced.GV-04 records the rule.
Builder
An agent session doing the work.
Changes a watched path only when a spec lists it or a review passed in the last two hours.
This is the tolerance statement from the system's risk register, lightly edited. Anything whose worst realistic outcome is rework, noise, or a degraded page that someone notices within a week is accepted. Anything that can fail while still reporting healthy is accepted only if a detective control catches it within seven days, because silence, not failure, is what this system can't tolerate. Four things are not accepted at any score:
irreversible loss of data with no offsite copy;
disclosure of sensitive personal material to any surface the owner didn't approve;
an autonomous action against a third party (a send, a publish, a purchase, a delete) with no human checkpoint;
any breach of an employer's client confidentiality.
6The risk register
13 risks shown. After their current controls: 0 Critical · 3 High · 9 Moderate · 1 Low. 9 of the 13 sit outside the tolerance above. 1 more is withheld from this version, because describing it would disclose what it protects. It is outside tolerance.
Risks that haven't happened yet, scored against the tolerance above. Tap a risk to open it. This is the register behind GV-01, with names and paths removed. Likelihood and impact are 1 to 5 judgments, not measured rates; the score is their product. Before is without the current control, after is with it. Scored 2026-08-07, re-scored 2026-09-29 by the builder, not independently. Next review 2026-12-29, 3 months after the last.
R1A guard against an irreversible deletion goes inert after a tool is renamed, and nothing notices10 HighOutside tolerance
OP-01, OP-02. Re-authentication procedures and a job watchdog. A single-credential version happened on the review date: jobs failed for about two hours, recovered on their own, and were found by a manual check.
Treat
Mitigate
Change
Unchanged score. Partly realized.
R8An operating-system upgrade breaks many scheduled jobs at once9 ModerateOutside tolerance: no reliable detective control
OI-04. Spend needs a yes before a metered workflow runs. The spend audit runs on demand only; the daily scheduled audit checks for exposed keys, not spend.
Treat
Mitigate
Change
Moved out of tolerance. The August scoring assumed a daily spend check that doesn't exist.
R11Agents act on standing rules that have since changed6 ModerateInside tolerance
None. No pause switch, stand-down procedure, or successor.
Treat
Accept
Change
Unchanged. Accepted explicitly: one person can't be engineered away.
7Oversight and review
The risk register is re-scored every quarter, and whenever a risk happens or a new autonomous surface is added. Last re-score 2026-09-29, next due 2026-12-29. The mission and objectives are reviewed at the same sitting.
Each significant failure gets a root cause and a corrective action that's tracked until it closes (OP-04). The postmortems are published.
Control tests run when something changes, not on a timer. No control is re-performed on a sample over time.
The builder scored the register and mapped the controls. Nobody independent has reviewed either.