Patterns
The rules my systems keep reusing: where they apply, where they fail, and the real systems that earned them.
Last updated October 24, 2026.
Authority
The house contract
The AI drafts; a human enacts. Drafting is autonomous and unlimited; action waits behind a gate only I can open.
- Use when
- An agent's output can change the world outside its own files.
- Limit
- Applies to consequential actuation, not every model-assisted edit; a draft in a git branch needs a reviewer, not a ceremony.
- Earned in
- The coach's rebuild · The watch button
Propose, don't execute
The model returns a verdict or a proposal; plain, non-AI code maps it onto a short allowlist and does the touching. What executes is the literal rendered change, never the model's prose.
- Use when
- The model's input includes text strangers can influence.
- Limit
- The allowlist is the security boundary; a wide allowlist turns this back into direct execution with extra steps.
Earned autonomy
Agents start powerless and buy privileges with measured track records: shadow first, then advisory, then one narrow verb at a time, on a schedule of trust written down before the agent exists.
- Use when
- An agent wants a new verb.
- Limit
- This is the current policy, not a claim that every agent historically walked the full ladder; and a record only counts if something could have failed it.
- Earned in
- The guardrail · The red pen's payoff · Mailroom writes back
- Applied by
- Mailroom
Structural absence beats in-loop refusal
The capability an agent could be talked into misusing lives in a separate worker with no persona, history, or private tools, and the agent gets one hand-off to it per turn. Code refuses the second call at execution, even when the first one failed.
- Use when
- An agent needs one capability that reads the outside world alongside private tools that planted text could otherwise steer.
- Limit
- Code must strip reserved parameters where model arguments enter and force safe values at execution. Returned text may still steer private tools; the spent hand-off leaves no channel for the result.
- Earned in
- Pepper gets one phone call
- Applied by
- Pepper
Evaluation
Graders need graders
Every gate that scores an AI system gets audited by something that can fail it. Validation checks, referees, exams, and my own answer keys have each been caught wrong by the next grader up.
- Use when
- A gate's verdict decides a promotion.
- Limit
- The chain terminates at a human reading the actual cases; it's graders all the way up only until someone does the boring adjudication.
- Earned in
- The red pen · The Bitter Lesson audit · The review-loop essay · My reference model disagreed with itself
- Applied by
- Mailroom
The red pen
Corrections are a curriculum. When I fix an agent's mistake in the tool where it happened, the fix gets banked and studied on a schedule, and the agent rewrites its own instructions from the pile.
- Use when
- The same judgment call recurs enough to bank corrections against.
- Limit
- Only explicit corrections teach; silence teaches nothing, and unbanked fixes evaporate.
- Earned in
- The colophon · The red pen post · Mailroom writes back
A configured control isn't a verified control
A gate you set up is not a gate you've checked. It can be configured exactly right and still sit off to the side of the path real traffic actually takes, so the only honest test is a probe from outside, along the route a stranger's request would follow, read from raw responses and redirects rather than a summary.
- Use when
- Any "is X reachable" or "is X protected" claim.
- Limit
- An external probe proves one path at one moment, and caching or a trusted vantage can still lie, so record where the probe ran from.
- Earned in
- The door I hadn't actually closed
Replay it against its own history
No filter change on an agent's tool path ships until it has been replayed against that agent's recorded command history. Two independent reviewers are still two readers of the same synthetic test cases; the commands the agent actually ran are evidence neither imagination wrote.
- Use when
- Changing any deny list, allowlist, or parser that sits between an agent and its tools.
- Limit
- A replay covers only command shapes the history contains; a genuinely new capability still needs synthetic cases.
- Earned in
- The review-loop essay
A pass is not a clean bill of health
Some failures I stage on purpose, on a schedule: faults fired at a container that exists to be broken, and files read back out of my backups. A drill that passes at the layer I worried about is permission to look one layer deeper, not proof the rest is healthy.
- Use when
- A monitoring path has been quiet long enough to distrust.
- Limit
- Drills prove the paths they exercise, nothing else.
Silence isn't feedback
Only explicit verdicts count as training data; an unanswered pitch records nothing.
- Use when
- Learning taste from reactions.
- Limit
- Requires the system to tolerate sparse data rather than inventing signal.
- Earned in
- The story scout
- Applied by
- Scout
Operations
The fire marshal rule
Whatever watches a system must not live on it; the thing that must outlive a failure runs somewhere the failure can't reach.
- Use when
- Placing anything whose job is detecting that a host is down.
- Limit
- The second machine is now its own thing to monitor; the rule relocates the single point of failure, it doesn't abolish it.
- Applied by
- Columbo
Send first, or save first?
Some actions have two halves: send a message, and save a record that it was sent. A crash between the halves leaves one without the other, so you pick the order by asking which leftover is worse. For a warning, the record with no message is the dangerous one (the system believes people were told when nobody was), so the message goes first. For an "I'm alive" check-in, the message with no record is the dangerous one (the system forgets it heard from you and raises a false alarm), so the record goes first.
- Use when
- A crash between two steps lands differently depending on order.
- Limit
- Either order can produce duplicate messages; that's the accepted cost.
- Earned in
- The switch I hope never fires
Change management
One-way doors
Stay reversible as long as physically possible, and walk up to the point of no return slowly instead of stumbling through it.
- Use when
- A step, once taken, cannot be untaken (data, hardware, public disclosure).
- Limit
- Most changes are two-way; giving every reversible change the one-way ceremony is how nothing ships.
- Earned in
- The storage migration
The melt check
Scaffolding that compensates for a model's limits gets tagged with the assumption it rests on, and every model upgrade re-tests those assumptions: whatever the new model matches bare, delete that day.
- Use when
- A workaround exists because of what today's model can't do.
- Limit
- Values, world facts, and verification are not scaffolding and never melt; the tag distinguishes them.
- Earned in
- The Bitter Lesson audit
A pattern earns its place by surviving contact with at least one real system. When a post retires a pattern, this page says so. The agents applying them live on Agents.