Designing the boundary between agent action and human judgment.
Trust ArchitectureAgentic SystemsHuman-in-the-LoopBuilt in Production
The Problem
Teams Make Decisions. The Reasoning Behind Them Collapses.
How evidence becomes a decision →
Interview
→
Insight
→
Synthesis
→
Recommendation
→
Decision ⚠
The Symptom
Documentation exists. Decisions get recorded. But the connective tissue between evidence and output is invisible.
The Real Problem
When an assumption changes upstream, there's no signal downstream. Work becomes stale with no way to know it.
The Design Question
Where Does the Agent Act, And Where Does It Stop?
Fully Automated
Fast, erodes trust
Agent overwrites things. Promotes outputs that aren't ready. Trust collapses.
Right Balance
System surfaces, human decides
System acts on routine work. Surfaces uncertainty for human review. Trust compounds.
Fully Human
Trustworthy, too slow
Agent asks permission so often it's not worth using. Automation has no value.
Every design decision in Stacks and Vera — every constraint, interaction pattern, UI decision — is an answer to this question.
RESPONSIBILITY
My Role
I designed and built this end-to-end. No team, no brief, no client. I mapped the system, defined the data model, designed every surface, and shipped it in React and TypeScript using Cursor and Claude as daily tools. Everything you're about to see is mine."
What I owned:
• Interaction model and governance layer
• Every UI surface — the Spine, lineage panel, semantic layer, movement drawer
• The reverberation system — how upstream changes propagate as flags, not overwrites
The Interface
The Spine: A Layout That Encodes a Mental Model
The Interaction Pattern
Propagation: The Interaction That Defines the System
The Foundation
The Governance Layer — Designed Before Any Surface.
Visibility Ceiling & Movement Events
Agents capped at client_shareable. Never client_facing. A human must decide something is ready to leave the building.
Every agent action emits a permanent audit record — what changed, who did it, why. Attributed to agent:vera, not anonymous.
Canonical
Source of truth. Immutable to agents. Promoted only by humans after review.
Human only
human review required
Proposed
Agent ceiling. Ready for human review. Visible and traceable, not yet trusted.
Agent ceiling
Draft
All agent output starts here. Never auto-promotes. Requires human action.
Agent floor
The Agent Layer
Vera
CLI-based · Running in production · No UI by design
What Vera does
Monitors evidence for gaps and drift · Detects staleness · Generates candidate assumptions · Produces governed artifacts from structured evidence
The interaction model
Agents propose. Humans approve. Candidates live in /candidates/ until a human moves them.
⚠️
#project-vera-alerts
Risk RISK-003 has no testable assumptions
3 candidates generated → Review and approve
# Run monitor check
vera monitor
2 gaps detected
1 drift warning · Slack alert sent
# Generate artifacts
vera generate artifacts
roadmap.md ✓ [EV-001] [EV-004]
strategy.md ✓ [HYPOTHESIS] flagged
scope-check.md ✓
Confidence → Language rules enforced, not suggested
High
"The system should..."
Medium
"Evidence suggests..."
Low
"Current hypothesis..."
Design Judgment
Three Decisions Worth Discussing.
Decision 01
Why can't agents promote to canonical?
Trust is earned incrementally, not granted by default. More automation feels like more value — but there's a category of decision where the cost of getting it wrong is high enough that it has to be a human call. The agent ceiling isn't a limitation. It's the design.
Decision 02
Why does reverberation flag instead of auto-update?
Automated propagation sounds efficient. It's wrong. When an upstream assumption changes, the right downstream response depends on context the system doesn't have. The flag model is slower — but it preserves judgment at exactly the moment judgment matters.
Decision 03
Why are movement events structural, not a feature?
I built the audit trail before most of the UI. If you treat auditability as a feature you add at the end, you get incomplete coverage. For agentic systems, humans need to see everything the agent did. Not a summary. Everything.
The Connection
Wrap-up
This started as a systems problem. The governance model, the trust contract, the propagation logic — that came first. The craft followed. Every interaction, every transition, every visual decision was made in service of the system. The result is something I designed, built, and shipped