Corey James- 326active actions in one busy work order
- 9states each of those actions can be in
- 52legal transitions in the whole governance map, across all states
A language model is a superb worker and a terrible authority. It will do the task in front of it with skill, and it will also decide it has permission it was never given, declare a step complete because the transcript reads that way, and talk itself out of a rule that is inconvenient. Every failure I had with autonomous agents came back to the same cause: the model was being asked to hold the authority as well as do the work. I now build systems where the model never decides what it is allowed to do, what step it is on, or whether it is finished. External rules, data and machinery decide all of that.
The shape
State lives in a database, never in a prompt. A job is rendered from that state at dispatch time, small and contract-bound, and nothing is carried from job to job inside the model's context. Policy is enforced by hooks that refuse forbidden actions; a rule is a refusal, so no prompt has to remember it. Completion is judged by evidence that exists in the system, examined by a reviewer that did not do the work, and a work order closes as one act over all of its acceptance evidence. Where the model wants a capability, the capability is granted by the system, not claimed by the model.
The arithmetic is the reason this has to be structural: no prompt and no test suite can cover the configurations of one busy work order in my governance platform, and a governance map of legal transitions can.
One busy work order: every cell an action, every shade a state.
From most positions there is exactly one legal next move; every other move is a refusal.
Where it appears
In AgentOS it is the whole design: a PostgreSQL work graph as the only source of truth, hooks that turn policy into refusals, independent reviewers from a different model family, and evidence-gated close. The diagnosis behind it is in Why long agent runs fail; the review structure in Separation of duties for AI work; the close rule, held for two weeks against the agents' own "done", in Closed by evidence.
In Agent Swarm, an agent cannot call a tool it was not granted, every call passes a frozen pipeline the agent cannot bypass, and the gatekeeper that opens merge requests is a different agent from the one that writes code: Tools are the platform and A coding agent that never holds the keys.
In FAFO Core and Function Forge, an agent can write a new tool, and the tool takes effect only when a human rebuilds and restarts the gateway; the generated code sees a context object rather than resources: Tools that build tools, under governance.
In FAFOHive, the gateway derives an agent's identity from how it authenticated, never from what it claims in a tool call, and a budget that an agent cannot raise sits in every provisioning path.
What it buys and what it costs
It buys trust: a program run this way can be audited, because the history of what happened was produced by the system rather than narrated by the worker. It buys swappable models, because a job that carries its own contract does not care which model fills it. It buys recovery, because the state survives any session.
It costs speed on the happy path. A lead agent that cannot edit an artifact feels slower than one that can. A close that waits for independent evidence takes days longer than one that trusts the builder. I pay that every time, because the alternative looks fine for a day and cannot be trusted for a week.
The judgment in it
The hard part is resisting the obvious shortcut: the model is right there, it can see the state, why not let it decide? Because it will be right most of the time, and the times it is wrong will be confident and invisible.
Anything the system can decide deterministically, the system decides, and the model is left with the work that requires judgment.
That is also where the model is at its best.