Everyone says they have a process.
Here, you can scroll through a real one.
This is the journey of one real feature — a read/save/archive system for Geopol Radar, an intelligence-analysis platform the factory built and runs. Real artifacts, lightly sanitised: internal names, identifiers and rule-codes removed, nothing else changed. The original documents are in Danish — the factory’s working language — with the load-bearing parts annotated in English. What you’re about to scroll through happened 2,863 times.
A named person wants something real.
The client — Lars, a senior analyst — wants to track which articles he has read, save important ones for later, and archive the finished ones. That’s it. No epic, no workshop series, no requirements phase. One person, one need, written in one sentence at the top of the work order:
# DISPATCH 2 (P2): Læsestatus-system
**Max ændrede filer:** 3
**Prioritet:** P2 (middel kompleksitet)
## Kontekst
Lars vil kunne tracke hvilke artikler han har læst,
gemme vigtige til senere, og arkivere færdige.
“Max ændrede filer: 3.” The agent’s blast radius is capped before a single line is written. Scope creep isn’t discouraged — it’s impossible without a new work order.
Not a prompt. A contract.
The dispatch hands the agent everything it needs — the database schema (already created and locked), the exact files to touch, code-level guidance — and everything it may not do. Note who’s allowed to do what:
### Database er KLAR Tabellen `item_read_status` eksisterer allerede. **Logik:** INGEN row = ulæst. Row med status='read' = læst. **RLS:** Agenten skal IKKE ændre database/RLS. ## Accept-kriterier - [ ] Klik på "Marker som læst" gemmer status via backend - [ ] Tabs fungerer: Aktive / Gemte / Arkiverede - [ ] Toggling virker (klik igen = fjern status) - [ ] Preview build OK (ingen TS-fejl) - [ ] grep -rn 'TODO|FIXME|PLACEHOLDER' src/ = 0 nye hits ## Regler - Push branch, levér branch-navn + commit-SHA - Opret ALDRIG PR eller merge til main - Kald ALDRIG dit arbejde "done" — sig: "Branch klar til review"
“The agent must NOT change the database.” Authority boundaries, in writing. The data layer was designed and locked by a different role — segregation of duties, applied to machines.
The placeholder-grep is an accept criterion. Zero TODO/FIXME/PLACEHOLDER hits — checked mechanically, not on trust.
“NEVER call your work ‘done’.” The most abused word in AI is banned by contract. The permitted phrase — “branch ready for review” — describes a verifiable state instead of a feeling.
The agent builds — inside the fence.
A React hook for status state, changes to the article card, a third tab in the overview. Three files, exactly as contracted. The agent pushes a branch and reports it — in the contracted language: branch ready for review. It cannot open a pull request. It cannot merge. It cannot promote its own work one millimetre past the fence.
A second agent is paid to attack it.
Now a different agent — with a different mandate — reads the work. Not to summarise it. To break it. Here are four of the eleven real findings from one such review, verbatim from the QA report:
| File | Severity | Finding |
|---|---|---|
| Sources.tsx | Critical | Type-cast bypasses the database types for calibration fields — a misspelled column name would fail at runtime, not compile-time. |
| KildeVisning.tsx | Critical | any-cast removes all type safety on query results — hides the known column-rename migration. |
| KildeVisning.tsx | Important | No error handling on two backend calls — on failure the user sees nothing, not even an error. |
| SourceForm.tsx | Important | catch (err: any) — accessing .message can crash on non-Error throws. |
Every finding names the file, the line, the consequence and the fix. Not “looks good with minor comments” — a claim-by-claim attack. A friendly re-read catches none of this, because a friendly reader adopts the author’s framing.
Machines check what machines produced.
Findings fixed, the change faces the mechanical layer: the build must compile with zero type errors, the preview must deploy, the placeholder-grep must return zero hits, the accept criteria get walked one by one. None of these gates recommends. They block. If any state can’t be determined — unknown = blocked.
One person decides. On evidence, not eloquence.
Everything lands on a human desk: the branch, the review findings and their fixes, the green gates, the preview. The human — who never wrote a line of it — makes the GO/HOLD call and performs the merge personally. No agent in the chain could have merged it; the authority simply doesn’t exist on their side of the fence.
Then the deploy is verified against the live system — because a merge is not done, a deploy is not done, and the feature exists when a named analyst in front of a screen can mark an article as read. He can. It’s in production.
Now multiply by the whole factory.
Provenance: the excerpts above are from real working documents in the Geopol Radar repository (client named with permission), lightly sanitised per the factory’s publication ruling — internal agent names, session identifiers, infrastructure IDs and internal rule-codes removed; structure and content otherwise unchanged. The original working language is Danish.
This is what “AI with governance” actually looks like.
Not a policy document. A working machine with fences, attackers and a human hand on the merge button. I build this discipline into organisations — and I’ve run it on myself first.