Moving an agent from a supervised session into an automated pipeline gets treated as a deployment step. It is a redesign. An agent that behaves well when a person is watching depends on that person in ways that stay invisible until they are gone: someone to answer a clarifying question, to notice when a run stalls, to catch a wrong…

An autonomous consumer of a tool never sees the tool’s internals. It sees the value that comes back, and it reasons over that value as fact. This is the whole premise of tool use: the system asks, the tool answers, the answer becomes ground truth for whatever happens next. Hiding inside that premise is a failure mode that costs nothing to create…

Every result an automated system produces can be inspected except one. A record can be checked against the source. A number can be recomputed. A summary can be read back against the document it came from. But when a step reports that there is nothing, there is no artifact to examine. The absence of a result and the absence of a…

In most systems, results get a schema and failures get a sentence. The success path is versioned, validated, and reviewed; the failure path is a string someone wrote while debugging something else, and it survives untouched into production because nothing that runs regularly depends on its shape. That asymmetry is tolerable when the only consumer of a failure is a human reading…

Every failure in a running system is handled somewhere. It is swallowed by a component, absorbed by a retry, folded into a default value, or allowed to travel upward until something decides what it means. There is no such thing as an unhandled failure in production. There is only a failure whose handling location nobody chose. In most systems that location…

An agent that escalates has already done the hard part. It reached the edge of its competence or its authority, recognized the edge, and stopped. That recognition is what every oversight mechanism in the system was built to buy: the thresholds, the retry ceilings, the policy checks, the confidence calibration. All of it exists to produce one moment where the system knows it should…

Every constraint that lives inside an agent’s context is a constraint the agent participates in honoring. The system prompt telling it never to touch production, the instruction to validate before it writes, the policy tool it is supposed to consult first: all of these are inputs to a probabilistic process that decides, at runtime, what to do next. Most of the time…

Once a system decides it should stop and ask a person before acting, the attention usually goes to the human: whether they are diligent, whether they read before they approve. That is not where the design lives. Deciding when to escalate is a separate problem, and a well-studied one: the triggers that fire a review are their own design artifact. But once a…

Putting a human in the loop is the standard answer for the moments when an autonomous system should not act alone. It is also the answer that is easiest to get wrong, because the mechanism everyone talks about, the review step itself, is not where the design lives. The review is downstream. What actually determines whether human oversight protects anything is…

Once you accept that code, not a prompt, has to enforce a high-stakes constraint, the interesting question is no longer whether to add enforcement but what that enforcement is as a piece of architecture. “Add a validation layer” is a slogan, not a design. A check placed where it cannot see the thing it is meant to catch protects nothing. A check that…