The last three articles make one argument: once you let software act for your business, the hard part is not the AI, it is governing it: deciding what each agent may do, proving it cannot do the rest, catching the safeguards that quietly failed. But there is a question underneath all of that, and it is the one I am proudest of the answer to. Rules have to change, because you get things wrong, the business moves, and a new agent arrives. So how do you change the rules of a system that can, in principle, rewrite itself, without letting it quietly loosen the rules that hold it back?
Rather than describe the machinery, let me walk you through one real change, start to finish. It is small and unglamorous, which is exactly why it is worth watching.
One change, start to finish
The fleet keeps an access map: a record of what each agent is, what it is allowed to reach, and how the agents hand work to each other. One of our regular tests does nothing but check that map against reality, walking each agent up to the systems it should and should not be able to reach. One day it found a mismatch: an agent could open a door the map never listed. Nothing had been breached. The map had simply fallen behind the real set of access, and nobody had noticed, because a map looks the same whether it is right or wrong.
Here is what happened next, and every step earns its place.
The audit did not fix anything. It raised a flag: here is a gap, the world does not match the record. Raising a gap is free and it changes nothing on its own. That is deliberate. Anyone, any agent or me, can say “this ought to change.” Saying so moves nothing.
Then it came to me. Carta, the control-plane agent from the earlier articles, wrote the change as an exact before-and-after: the record says this, reality is that, here is the precise wording that would make them agree. It handed that to me and stopped. I read it and approved the exact wording, the actual words, not the general idea. My reasoning went into an append-only record at the moment I ruled, so the why sits next to the what and cannot drift from it later.
Only then did the change get made, and not by Carta’s judgment. A dull, deterministic step wrote the approved words. It carries one guard worth knowing about: before it writes, it checks that the target has not changed since the before-and-after was drawn. If the document moved underneath it, even slightly, it refuses and we start over. In plumbing terms that is an optimistic-concurrency check: the write carries a version tag and is rejected if the version no longer matches. The guard is there because the most dangerous change is the one that lands against a file that shifted while you were not looking.
The correction did not need to be pushed anywhere. There is one central copy of the access map, and every time an agent starts a piece of work it loads that copy fresh, along with the shared charter and the other rules that govern the fleet. Nobody keeps a private duplicate, so nobody can quietly drift from the current version: the next time each agent worked, it simply picked up the corrected map. The one cost worth naming is that an agent already mid-session does not see the change until it starts its next one. We accept that short window on purpose; the alternative, pushing live edits into running agents, is exactly the kind of moving part governance is supposed to avoid.
And then the loop closed on itself. The next audit walked the same door again and checked the fix against the world, not against the record that had just been edited. A change is not finished when it is written. It is finished when something has measured it against reality and it held.
The parts, named
You just watched six pieces move. Here they are, and only one of them is a person.
- The shared charter. One rulebook every agent reads and points at, not a copy each, so the rules mean the same thing to all of them at once.
- The control plane. A single agent, Carta, whose whole job is to watch the fleet and keep it coherent. It reads everything and proposes changes; it applies none.
- The decision register. An append-only list of what was decided and, more importantly, why. You add to it, you never edit it.
- The access map. The record of which agent can reach which area, plus the small check that reads reality and compares it back, because the map goes stale in silence.
- The audit job. The scheduled thing that goes and tries the doors, to prove the locks still hold rather than trust that they do.
- The person, outside it. One human who sits deliberately outside the part of the system the fleet can change, holding the one gate nothing automated is allowed to open.
The person outside the loop
The one thing the machinery is not allowed to change on its own has to be a person.
Notice where I sat in that story. Every step was mechanical except one: a human read the exact change and ruled on it. That is not incidental. It is the whole design.
A fleet that can edit its own members could, in principle, edit the rules that restrain it. So the one thing the machinery is not allowed to change on its own has to be a person, standing outside the part of the system that can change itself. Carta can watch everything and propose anything; it cannot approve, and it cannot make the change itself. I can approve; I deliberately cannot reach in and rewrite the machinery in the same motion. The gap between proposing and approving is narrow, and it is doing most of the work.
Everything else exists to make that one human gate mean something instead of decaying into a rubber stamp: one change at a time for anything sensitive, the exact wording rather than the gist, the reasoning recorded as it happens, the deterministic apply, the re-check against the world.
What holds it up
The one piece with real teeth is also the least glamorous: the audit that reads reality and notices when it has drifted from the record. Writing rules down is the easy part everyone does. Building the dull thing that notices when the world stopped matching them is the part that was actually doing the work.
I will not tell you this arrangement cannot fail. I will tell you what it is built to make hard: loosening a restraint should take a human ruling that gets recorded, every time, so if it ever happens there is a name and a reason attached to it. Get that one thing right and the fleet can improve itself for a long time without quietly slackening its own limits. That, more than any single guardrail, is what I would want you to take from all of this.
What it cost, and whether it was worth it
The honest cost was my time. Not a neat line on a budget, just hours, a lot of them, over months. Reading, building, testing, and tearing down things I had already built to build them again. There were some real dollars on top: the agent licensing, the usage that runs up on every call to the models, a handful of tools I had to pay for outright. But most of the bill was me, working out how to make this hold together inside a company the size of mine.
What did it buy? The plainest answer I can give: work that used to land on me does not any more. The first drafts, the calendar and the inbox, the follow-ups that used to go cold, the paperwork around hiring. I did not remove a person to do this. I removed a pile of my own evenings, and got back the part of the week I would rather spend with clients.
I made that harder on purpose, and I would do it the same way again. I wanted the whole thing built out of tools we already pay for and already use every day: SharePoint, Teams, Lists, document libraries, the workflows sitting in the same subscription. Nothing exotic, no special platform you have to go and buy. If it only ran on some bespoke rig, it would be a science project. I wanted it built the way a normal person in a normal company would have to build it, on the ordinary tools that are already in the building, because that is the only version anyone else can copy.
I will be straight about one advantage I had. I have spent years around Azure security and corporate governance, so when I started reading how people think about governing agents, a lot of it rhymed with things I already knew, and I could stitch the two worlds together faster than someone coming at it cold. If you do not have that background, some of what I have described will take you longer than it took me. Worth knowing before you start.
And the cost that gets the least attention and mattered the most: getting us to actually use it. Building the agents was the easy part. The hard part was the human one. The people, the way we work day to day, the culture around bringing something new in. That is the same ground the whole company stands on, and the part the old website had forgotten, and it turned out we had to do that work on ourselves before any of this became normal. We were our own first client. Was it worth it, for a firm this size? For me, yes. If you are weighing it only on time saved this quarter, be honest about the hours first. The return is real, but it is not fast. And to be straight about it: this is not a product you buy from us off a shelf; it is how we learned. A company your size can get here, on the same ordinary tools. Just do the honest sum on the hours before you start, not after.
If you want the strangest proof that it works, the last piece is optional and a little cheeky: this whole series was put together by one of the agents it describes, under exactly the rules above.
