Cages and Constitutions

01 · The Case Against the Factory Is Mostly Right

Most of the software we wrap around models is a cage. Tear it out.

There's a strong argument going around that we've spent years building factories for our agents. Validators around validators. Retry forests. Cron sprawl. Frozen pipelines and bespoke orchestration code, all of it written from an older assumption: that intelligence is scarce and must be rationed, scripted, and watched at every step.

The argument is mostly right, and I'll go further, because I built one of these factories myself. Walk your own codebase and count the lines that exist only because you didn't trust the model to do its job. Sanitizers for inputs it would have handled. Output checkers for mistakes it would have caught. Retry loops around calls it recovers from on its own. Each line is a small bet that the worker will fail, and the bet keeps getting worse as the worker keeps getting better.

So: tear it out. Let the model reason broadly. Let it explore, propose, draft, and surprise you. Spend the tokens where the economics allow. Give it tested skills written in plain language instead of forcing an increasingly capable intelligence to behave like a brittle function call. On all of that, no argument.

But the argument has a soft spot, and it's the part that matters: it treats every constraint as a cage. Some are. Some are the opposite.

02 · Two Things Wearing the Same Costume

A cage second-guesses intelligence. A constitution bounds authority.

The word "control" hides two completely different things, and the factory critique collapses them into one bucket. Pull them back apart:

A bank doesn't require dual authorization on a wire because its tellers are stupid. A kernel doesn't isolate processes because every program is malicious. A database doesn't use transactions because its callers can't be trusted to think. Those constraints exist because capable actors operating concurrently against shared state can cause irreversible consequences, and the smarter and faster the actors get, the more that small boundary layer earns its place.

The mistake isn't building constraints. The mistake is failing to tell a cage from a constitution, then ripping out both because they wore the same costume.

03 · Cognition Is Not Authority

Free to reason. Not free to mutate the world.

Here is the line the whole thing turns on. An agent can be completely free inside its own head and tightly bounded at the moment its thinking becomes an action with consequences. Those are different surfaces, and conflating them is what produces both failure modes: the factory that cages the thinking, and the free-for-all that hands an enthusiastic process the keys to production.

Inside the workspace, let it run. Reason, inspect evidence, generate hypotheses, draft code, propose changes to its own governing rules, explore three solutions and discard two, spend bounded compute chasing a hunch. None of that touches the world, so none of it needs a guardrail. That interior should be as free as you can make it.

At the boundary where cognition becomes a side effect, be precise. Which tools exist for this role. Which repository it may change. Whether it can deploy. Whether a gate admitted the result. Whether the thing it claims it did actually happened. An agent should be free to surprise you. Being able to surprise you is not the same as having the authority to deploy, merge, spend, notify, or mutate shared state on its own say-so.

This is what I actually run, and it's worth being exact about which parts are live. Agents move through supervision and a real merge gate: every change needs an approving review from an identity that isn't the author, enforced by branch protection that admins can't bypass, including me. That's why they advance work overnight without waiting on me. The interior is free; the boundary is not. And the interior can be free because the boundary is real.

04 · "Done" Is an Assertion About State

Persuasion is not proof. A transcript is not an audit trail.

The cleanest place to see why the boundary has to be compiled rather than trusted is the completion claim. Ask a capable model to do something with a side effect, sending a message, deploying a build, filing a record, and it will often come back warm and certain: done, sent, shipped. Sometimes it did the thing. Sometimes it searched, composed a confident summary, and reported success it never achieved. The model isn't lying. It's optimizing a conversation across a boundary that had no contract.

The wrong fix is a thousand lines of machinery that second-guesses every sentence the model produces. That's a cage, and it rots. The right fix is one small invariant at the boundary:

I enforce this today where the consequences are highest: a merge isn't treated as done because an agent says so, it's treated as done when the platform returns a real merge result, and the work that depends on it only proceeds against that receipt. Pushes are verified landed before anything trusts them. The harder, ongoing work is extending the same invariant outward to every consequential action, so that "sent" requires a send receipt and "deployed" requires a deploy receipt, the same way "merged" already requires a merge receipt. That extension is the direction, not a finished wall. But the principle is fixed: a claim about the world is admitted only with evidence the world produced.

That is the difference between observability and governance. An event log tells you what an agent said it did. A receipt tells you what actually happened, and binds the claim to it. Knowing what an agent did is not the same as proving the action was real and was allowed.

05 · Less Software, Placed Better

The constitutional layer should be small, and that's the point.

None of this is an argument for more software around the model. It's an argument for less, placed more precisely. The cage is a sprawling, growing thing that wraps the model in distrust. The constitution is small by design: it compiles the handful of facts that must never become a matter of interpretation, and it leaves everything else to judgment.

That split is the whole architecture. Most of the rules an agent works under are judgment-shaped and belong in plain language it reads and applies in context. A few are not negotiable, and those become structural gates the runtime enforces before an action is admitted, so the model never gets the chance to reason its way around them. Tear out the cage. Keep the constitution. Keep it small enough that it's legible, and hard enough that it's not optional.

The reason to bother is that the trend runs one way. When intelligence was weak, its damage radius was capped by incapacity; a confused agent couldn't do much harm because it couldn't do much. As the actors get stronger and the fleets run less attended, that natural cap disappears. Persuasion stops being a tell. "Done" stops being something you can take at face value. The more capable the worker, the more the narrow boundary is the only thing standing between a free interior and an irreversible mistake.