Let an Agent Ship Work While You Sleep Without Letting It Decide Anything
The design question that came out of a crashed orchestrator: how do you let an agent run unattended without ever giving it a decision to make? A closed decision table, four failed review rounds, and the line between orchestration and judgment.
After the orchestrator wrote 549 GB and panicked the kernel, the fix wasn’t more guardrails. It was a harder question. How do you let an agent run unattended, ship work while you sleep, without ever giving it a decision to make?
“Autonomous” sounds like an all-or-nothing grant. You flip it on, and now the machine decides things. It isn’t that. It’s a line you draw between two different jobs, and everything on one side of that line stays yours, permanently.
Orchestration, not judgment
Orchestration is applying a fixed rule to a task and a verdict. Clear inputs, one deterministic output. If X, then Y. A machine can do that unattended all day.
Judgment is weighing goals, stakes, or importance. Deciding that this failure matters more than that one. Deciding whether the cost of being wrong is worth the time saved by not asking a human. That’s not a rule you can write down and hand to a machine. That stays mine.
Once I had the two terms separated, “autonomy” stopped being scary. It turned into a narrower engineering problem: close every loop on the orchestration side, and route everything else, without exception, to a human.
The keystone: a table you can actually close
The artifact that made this real was small. An “auto-land” decision table, roughly ten rows, mapping every reachable combination of task type and review verdict to one of three terminal actions: land it, escalate it, or block it.
“Closed” is the word doing the work. Closed means every state the system can actually reach has exactly one row that covers it. No row means no autonomous action. That case falls to a human by construction, not because someone remembered to write a check for it.
That’s the whole design. A lookup, not a model. Nothing in it weighs anything. It just answers “have I seen this exact combination before, and do I know what to do with it.”
What “mechanical” cost me to prove
I want to be honest about how this actually went, because the table did not come out closed on the first pass, or the second.
It took four rounds with an adversarial reviewer before I could call it done. Round after round, the reviewer found a state the table didn’t cover. One was a “no review ran, default config” case that fell straight through a gap nobody had drawn on the whiteboard. It was reachable. The table just didn’t know it existed.
The other one is the finding I keep coming back to. A routing rule let the machine autonomously route a task that had failed review. On paper that looked like orchestration: task in, verdict in, rule applied, action out. In practice it was judgment wearing an orchestration costume. Deciding what to do with a failure is exactly the kind of weighing I’d said the machine would never do, and I’d written a rule that let it do it anyway, and it took an outside reviewer to see that the two looked identical in the code.
“Mechanical” is a claim you have to prove against every state the system can reach. It’s not something you get to assert because the code happens to look like a lookup table.
The guardrails that made it safe to trust
A few things sit around the table, and none of them are clever either.
Opt-in, not default-on. Nobody gets auto-land turned on without asking for it. Bounded by risk tier and budget, so the blast radius of getting it wrong is capped before the first run, not discovered after. Default configuration preserves the old, human-only behavior exactly, so turning the feature off costs nothing and turning it on is a deliberate choice. And it fails closed. Anything ambiguous, anything the table doesn’t recognize, routes to a human. Never a guess.
The churn was the rigor
Four review-and-revise rounds on a ten-row table sounds like overkill until you count what each round actually caught. A reachable gap the first time. A judgment rule disguised as a routing rule the second. That churn is what “closed” means when you try to earn it instead of asserting it. You don’t get there in one pass, and if you think you did, you probably didn’t look hard enough.
Autonomy isn’t a permission you grant an agent. It’s a line you draw between two jobs, applying a rule versus weighing the stakes, and then you prove, state by state, that the machine only ever does the first one.