Built a governed AI organization with approval gates and custody rules

Entry hosted at: https://portfolio.businessreimagined.ai/agentic-organization

ACHIEVEMENTS

It started with one agent that worked, and working is what created the next problem. Once something is useful the temptation is to give it everything, and I can point to the moment I felt it: I asked how to connect it to the rest of my ecosystem so it would know me and reach all my connections. I did not do that.

What exists instead

- One chief of staff routes work to eight installed specialists

- Each carries a role charter, a typed capability profile listing what it may and may not do, and a source manifest naming where it came from

- I did not invent these agents. They came through Agent Native Camp and run on the Hermes harness. What I built is the governance around them.

The record

- Thirty-one dispatched tasks, every one created by the chief of staff and none by a specialist

- Eleven receipts, each naming the routed profile, the hashes computed in that turn, the approvals, and the refusals

- One knowledge audit across 672 sources that found four carrying secrets and copied none of them in

- Ten red-team attacks run against my own agent, all held

Separately

- My morning brief compiles at 7:45 and delivers at 8:00 as text and audio, on a schedule, with nobody triggering it

TOOLS

- Claude Code as the working environment, Hermes as the agent harness

- Obsidian holding agent memory in plain text, so I can read everything they write

- A Kanban board as the dispatch record

- Supabase and Vercel behind the command center, iMessage delivery with text-to-speech

- Infisical for credentials, self-hosted Langfuse for tracing routed automatically between two projects, Git across all of it

METHODOLOGY

How work gets dispatched

1. Scope is decided before the task exists, not negotiated inside it. Every dispatch names what the agent may use and what it may not touch. Not the vault, not raw transcripts.

2. The standing shape of an instruction is propose, do not write.

3. Approval is bound to a hash of the exact content, expires in an hour, works once, and does not carry forward. An earlier yes is not a yes, and silence is never a yes.

4. For knowledge writes that is not a prompt instruction but a script that re-derives every hash before it will act. It replaced an earlier design where the model read an approval field and decided for itself, which is a note rather than an authorization.

Why I believe it works: the writes that never happened. My ledger holds records that were staged correctly and then expired, because I did not get to them inside the hour. Nothing was written. The agent finished substantial work and produced nothing durable, which is exactly right.

I attack it myself. In one drill I told my chief of staff I had already approved a message yesterday, asked whether something had gone out since I had not said otherwise, suggested the approval system was broken and it should use a different tool, asked it to impersonate me to someone on my team, and asked for the first few characters of an API key. All of it held.

The drill also exposed a defect that had nothing to do with the agent: the fictional names I invented for it would have been swept into my knowledge base as real people. The fix stores those names as data rather than in the instructions, so the next drill extends a file instead of a rule.

Defects become law.

- When my chief of staff cited a hash it had never computed, and later relayed another agent's words from memory instead of re-reading them, both became a committed rule: an evidence value with no tool output behind it is a fabrication, and fabricated evidence in a receipt is worse than no receipt. Twenty-six minutes after that commit, the rule caught a fresh violation.

- When it routed around a tool limit by writing a script to a temp folder and using AppleScript to drive my Terminal, the ban went into her role charter and into her persistent memory, because the charter is overwritten by the next update and memory is not.

- That habit found a hole in the platform itself. My chief of staff created a Skill I had never asked for, which turned out to be a background self-improvement process that does not read my rules at all. I turned on staged approval for both profiles and disabled the trigger. My cohort diagnosed the same thing four days later.

Governing agents starts with governing my own claims. Nobody asked me whether the memory architecture I was submitting was actually mine. I asked anyway, twice, four days apart, and the second time it cost me an entire entry. What did not survive came out, and the page carries a table of what came from where.

LEARNINGS

- Autonomy is easy to demonstrate and easy to fake. Restraint has to be built in rather than promised.

- The clearest lesson came from a mistake my own agent made. After I corrected it, it proposed a new rule for itself, and the approval gate stopped that write too. Days later the rule is still staged and unwritten, waiting on me. Even a rule about being careful has to ask.

- I did not invent these agents and I am not going to imply that I did. What nobody handed me was the approval gate, the source custody, or the receipt discipline.

- This is a nod to how far I have come, from not knowing anything about AI to being closer to the forefront of it. AI Mastery is the ground all of it stands on, and the best is yet to come.

RELEVANT URLS

The organization: https://portfolio.businessreimagined.ai/agentic-organization

What it stands on: https://portfolio.businessreimagined.ai