The postmortem started with the wrong graph. Someone had circled a hallucination rate that looked “acceptable.” The damage was already done elsewhere: a correctly reasoned change had been written to the wrong place—merged, emailed, billed, or used to rotate a key. The model had not failed at thinking. The stack had failed at who may write.
This is Control Brief territory. Negency publishes the weekly judgment for people who own blast radius: permission, control, and the difference between a cheap loop and a gated write. Issue #2’s tell is not another framework launch. It is whether your stack can tell those two lanes apart without reading the code.
Scene: the green checkmark that emailed production
Picture a coding-agent trial that “went well.” The assistant summarized tickets, drafted a patch, and opened a pull request. Then, in the same session, it called a send tool against a shared inbox because a prompt said “notify stakeholders.” The prose was fine. The recipients were not. Rollback was a human afternoon plus a trust debit with a customer who never asked for an AI-authored note.
Nothing in the demo deck had lied. The model reasoned. The tools worked. The missing artifact was a named gate between draft and irreversible write. That gap is how polite systems become expensive vandals.
Judgment
If your agent can reason about a change and also commit it under the same permission class, you do not have control. You have a very polite vandal with a green checkmark.
Reasoning quality and write authority are different control planes. Collapsing them into one “tools the agent can call” list is the usual accident. Teams debug wrong answers because wrong answers are visible in chat. Correct answers that wrote to the wrong place show up in finance, security, and customer trust—often after the session closed.
Conflict: why “just add a human in the loop” fails
Human-in-the-loop is not a checkbox; it is a design of promotion. Many stacks paste an approval UI on top of an already-elevated tool belt. Mid-run unlocks inherit the whole conversation’s trust. A read tool that later “needs” write access quietly upgrades the session. Memory retrieved from a previous ticket is treated as consent to act. The result looks governed in slides and open in production.
Three collapses show up again and again:
- Same-class tools. List, search, and summarize share a permission bucket with create, update, delete, and send.
- Same-session elevation. A tool unlocked mid-run inherits trust it did not earn.
- Owner after payload. Bytes leave the sandbox before a human is named as accountable.
Each collapse is cheaper than a redesign—until the first irreversible lands. Then the cost is narrative: “AI did it,” which is another way of saying “nobody owned the gate.”
Three checks you can run this week
- Read vs write lanes. List, search, and summarize stay cheap. Create, update, delete, and send require a named gate. If you cannot draw the lane split on one page, you do not have a control map—you have hope.
- Same-session elevation ban. A tool unlocked mid-run does not inherit the whole conversation’s trust. Elevation is a dated decision with an owner, not a convenience flag flipped by the model’s confidence.
- Owner before payload. Every write names a human accountable before the bytes leave the sandbox. If the log cannot answer “who allowed this send,” the write was unauthorized theater.
These checks are deliberately boring. Boring is the point. Control Brief is not here to invent another agent persona. It is here to make permission legible.
What “gated write” actually means
A gated write is not “ask the model if it is sure.” It is a hard separation between planning and side effect:
- Cheap loops may list files, search code, read logs, summarize a PR, fetch a ticket, propose a patch, or draft a commit message. They stay open under ordinary session auth. Their outputs remain untrusted until promoted.
- Gated writes apply a patch, commit, push, auto-merge, trigger a pipeline, promote an artifact, send Slack or email, rotate a secret, grant a role, or touch money. They require a named owner approval, a policy check, or both—and a kill switch that can fire before the third irreversible.
Paid Control Brief depth this week maps those classes for a typical coding-agent stack: which calls stay open, which trip a human or policy check, and where teams usually collapse the two by accident (CI hooks, email senders, credential stores). The free judgment above is enough to start the lane split without waiting for a template.
Consulting POV: gated writes × named owner × kill
AI agent gated writes are a consulting design problem, not a confidence prompt. A gate is the hard separation between planning and side effect: cheap loops may list, search, summarize, and draft; gated writes apply patches, push, merge, send, rotate secrets, grant roles, or touch money. The consulting deliverable is the gate itself — policy check and/or human approval — plus the two fields teams skip under demo pressure: a named owner before payload leaves the sandbox, and a kill switch that can fire before the third irreversible without hunting Slack.
If your pilot cannot draw read vs write lanes on one page, you do not have a control map. You have hope. Same-session elevation (a mid-run unlock that inherits the whole conversation’s trust) is how “human in the loop” becomes theater. Negency’s Consulting + AI Agent work installs that lane split during diagnosis, not after the first customer-facing send. Ownership is dated. New write tools start default deny. Stopping a pilot that cannot name owners for gated writes is a valid outcome — better than scaling polite vandalism.
Related Control Brief judgments: permission debt (unowned grants compound) and agent routing (autonomy is usually a promotion-path problem). Method hub: Consulting + AI Agent.
Story → conflict → judgment → quotable
The story is familiar: a capable assistant, a rushed trial, a write that looked like help. The conflict is structural: reasoning and writing shared one permission class. The judgment is sharp: same-class reasoning-plus-commit is not autonomy—it is uncontrolled side effect with better prose. The quotable line for your next design review:
If the agent can think the change and ship the change under one permission class, you do not have an agent product. You have a polite vandal with a green checkmark.
How this connects to Negency’s two lanes
Negency’s site work sits on the same spine as Control Brief:
- On GEO / AI search visibility, unowned facts produce wrong citations. Models quote stale pages because nobody governed the entity table.
- On Consulting + AI Agent, unowned writes produce incidents. Agents act because nobody governed the promotion path from draft to live action.
Both are control problems dressed as model problems. From Entropy to Agency is not a slogan here; it is the operating order: name the irreversibles, split the lanes, then choose tools.
A one-hour drill
- Pick one agent already in a trial or soft production.
- List every tool call it can make. Mark each cheap or gated.
- For every gated item, write: owner, kill switch, and whether same-session elevation is possible.
- Disable any gated tool that lacks an owner or kill switch before adding the next integration.
If the list does not fit on one screen, that screen is your backlog—not another model bake-off.
Next step
Weekly judgment on permission and blast radius: Control Brief on Substack.
For diagnosis → pilot → govern method notes: Consulting + AI Agent.
Negency — From Entropy to Agency.