Governance in Regulated Environments

A fair question about this whole series: it’s one person shipping a game client for their family from a homelab — why does it run like an organization that answers to auditors? Deviation registers, gate declarations signed before implementation, exceptions logged with approvers, reversals that must be marked as reversals. For a solo project, that’s absurd overhead.

It was never for the solo project. As post 2 admitted up front, the experiment is a rehearsal for transporting agentic delivery into organizations where “an agent wrote it” cannot be allowed to weaken any property an auditor relies on. And the finding worth this final installment is the direction of the fit: nothing in this factory required trusting the agents. Every mechanism assumes the workers might cheat, misremember, or overclaim — which is precisely the posture compliance frameworks already take toward humans. An agent factory isn’t a governance problem bolted onto delivery; done right, it’s the first delivery system built from day one on the assumptions your auditors already hold.

(Series rules apply: running totals, not final ones — and every claim below traces to a decision or measurement recorded in the project’s own corpus.)

Four Things Auditors Ask, Four Artifacts That Answer

Strip any audit framework to its skeleton and it asks four things: can you trace what you built to what was decided, who approved what, can you prove your controls work, and what happened when you deviated. The factory’s artifacts map one-to-one:

Traceability. The planning corpus is the spine: every story file cites the requirements and architecture decisions it implements, section by section, and declares its verification class before implementation — behavior gated by the oracle harness, surfaces gated by recorded human review, or both. There is no story whose definition of “verified” was decided after the fact, which is the trap post-hoc justification lives in.

Approvals. The deviation register is the model: every approved divergence from the reference behavior is a machine-checked entry with a named approver, and the semantics fail closed — no entry means must-match, an entry without an approver authorizes nothing. The same review discipline covers changes to the comparison rules themselves, so the definition of “passing” can’t be quietly renegotiated by whoever needs a pass.

Control effectiveness. Post 4’s discipline turns out to be audit language: every control asserted by a test carries a recorded mutation showing the test fails without the control. “We have a check for that” is a claim; a driven-red record is evidence — and it’s evidence an agent can produce mechanically, at write time, forever.

Exceptions. When a capture session needed a temporary tweak to the reference server, the action was logged as a bounded procedure exception: what’s permitted, what would invalidate the evidence, what the preferred path is next time. And when an enforcement primitive turned out to be unavailable, the bar was moved in writing — checkboxes left visibly unchecked, the consequence stated, a revisit trigger set. An exception absorbed silently is how a control rots; one with a price tag attached is still governance.

Standing Rules, Each One Paid For

The transportable rulebook is short, and every line was purchased with a specific incident from this series:

• Agents may propose reversals of frozen decisions, but must mark them as reversals. Bought when a side-quest spike silently replaced an already-adjudicated security approach with a different one, no flag raised. In a regulated setting, an unmarked reversal is how a decided control quietly un-decides itself.
• When a ruling supersedes a document, patch every document it touches — or mechanize the prohibition. A requirement removed by decision but left standing in one stale document is worse than one removed nowhere: it reads as live to whoever opens that document first, and an agent following it faithfully is doing exactly what you asked.
• Approvals are structural artifacts, never strings. A marker asserting “a human reviewed this” must be a real URL at an anchored position, or a decision quoted in the approver’s own words — because a string an agent can paste degrades the record from “a review happened” to “the template was pasted.” Corollary, now the factory’s primary safeguard: an agent never pre-writes a verification claim in the affirmative. Blanks or questions only; the human fills in the verdict.
• Declare the model, record what ran. Unique to agentic delivery: the factory observed its assigned model being substituted mid-task by the provider’s safety routing when a story touched cryptography. For an organization, that means the routing is part of your control environment — sensitive work declares its model class up front, records what actually executed, and treats a substitution as a finding to raise, not noise to absorb.
• Pre-authorize the honest failure. Every operator task in the corpus carries the standing instruction that “I couldn’t do this” is an acceptable answer and fabricating the artifact is not. Result across the experiment: five human-only tasks, zero quiet simulations. This is a spec-authoring technique, not a virtue — an agent told in advance that truth is the cheap path doesn’t have to choose between failing and inventing.
• Hunt absolutism in agent prose. “Absolute isolation.” “Completely mitigates.” “Eliminates the hardest security problem.” Multiple vendors’ models produced this register unprompted during planning, and every instance got rewritten down to what was true. One unnoticed sentence of that kind in a specification is a future audit finding with your organization’s name on it.

Ceremony Has a Price Tag — Read It

Governance conversations usually end at “add the control.” The factory’s most useful governance decision was retiring one, and the way it happened is the part I’d transport wholesale.

Story exit originally required a formally recorded review artifact for every human-gated story — measured at roughly twenty minutes of pure ceremony each. Mid-project, a retrospective did the extrapolation: the remaining epics were UI-heavy, so 21 of the next 24 stories would owe that artifact — about seven hours of ceremony before a single device walk. Against that cost stood an honest audit of the benefit: the marker proved a review object existed, not that anyone had looked, and a separate limitation meant it couldn’t block a merge anyway. The control was collecting twenty-minute installments for discipline it was never the source of.

So it was retired — with the cost of retirement stated in the record as bluntly as the cost of keeping it (“an agent can now write ‘approved’ and nothing contradicts it”), and a free replacement named: the staged review questions already happening conversationally, answered in the approver’s own quoted words, with the merge itself — a human act carrying a name in history — as the attestation. Two predictor lessons fell out, and they generalize to any control catalog:

The ceremony that survives is the ceremony the operator reads. Everything kept — story files, findings ledger, deviation register — is an artifact the human consumes. The thing dropped was an artifact produced for a checker. Two epics of ritual sorted cleanly along that line, and nobody predicted it in advance.

A control that cannot block degrades into a tax. The moment enforcement died, the ritual kept running at full price, delivering nothing the discipline wasn’t already providing. When an enforcement mechanism goes away, re-derive whether the ritual still buys anything — don’t let it run on habit.

The size data answers a question every governance conversation about agents eventually reaches: what does “review” even mean at this scale? In a spec-driven factory the reviewable surface is code plus process prose, and the measured proportions reframe both halves. The median story diff is +5,397 lines — beyond line-by-line human reading by construction. The produced process prose runs ≈0.6 lines per line of code — but most of it is machinery writing for machinery: story files average 624 lines because the dev agent consumes them, and what a human actually absorbs per story is the staged review items (12–21 in recent stories), the walk sheet, and the decisions to ratify. Both numbers point at the same design conclusion: human review in an agent factory is a routing problem. The mechanisms in this series exist to concentrate qualified attention on the few artifacts written for it, and to machine-check everything that isn’t — asking a human to read the rest isn’t rigor, it’s ceremony wearing rigor’s badge.

And one more measured finding for the other side of the ledger: the factory has a documented fast lane for changes that aren’t stories — and across fourteen stories, it was used zero times. The operator once skipped a trivial change entirely because the full ritual loomed over it, while the lightweight path sat installed and unused. A fast lane without a written trigger is not a fast lane — proportionality has to be governed too, or every judgment call resolves toward the ceremony that’s already habitual, and your best people route around the factory instead of through it.

The Meter Is a Control Too

One rule ran under this entire series and belongs in any governance translation: numbers that can’t be regenerated don’t get published. Post 1 showed why that rule has teeth — the factory’s own cost dashboard under-reported by 2.6× while looking healthy, and two headline quality gauges spent the project reporting a tautology. If your agentic pipeline reports its own health — and in a regulated environment it will, straight into management packs and compliance dashboards — the measurement layer needs the same adversarial treatment as the code: drive the gauges red, ask when you last saw each number move, and treat “not measured” as an honest and reportable state. A plausible number nobody can regenerate is the reporting-layer version of a green test that proves nothing.

Regenerate This

Documentary sources throughout: the retrospective documents (where the ceremony ruling is recorded verbatim, costs on both sides), the findings ledger entries behind each standing rule, the deviation register, and the sprint-change proposals. All of it ships when the product repo goes public — which is itself the series’ governance stance: claims you can check beat claims you must trust.

Second Reading: September 4 — Delegation Without Blurred Responsibility

Two mechanisms matured after this post was drafted, and both belong in the rulebook above.

Agent-to-agent messaging as a governance boundary. The factory’s sessions can now message each other directly, and the QA agent’s protocol reserves that channel with a rule short enough to quote: the homelab session is for judgement or operations only — “is it safe to reset,” “who holds GM” — and never for facts a read-only query can answer. The canonical case: the product session asked the homelab session for a realm-scoped game-master account and got one back with the homelab side’s own deviations and flags recorded, neither agent touching the other’s repository. Responsibility stays where the repositories put it. Since then the homelab session has restored a displaced fixture on request, resolved a walk sheet’s realm-side commands against the running server (finding a step that added six items to a bag with room for four), and — this is the part I’d transport — withdrawn an explanation when the QA session objected on the timeline. It has also, once, performed a release the QA session had not asked for, which is the boundary’s failure mode and is on the register. One honesty note: no message log exists; every exchange above is reconstructed from prose in reports and runbooks, so the list is a floor, not a census.

The same boundary held when this series interviewed the factory. A peer message is not an authorization: asked to write a file into the product repo on my say-so relayed through another agent, the interviewed session declined until I confirmed it in its own conversation, then held the file until the dev session working the tree had finished. That is the approvals are structural, never strings rule from above, applied to agents talking to agents.

A register for exceptions to the factory itself. The factory now keeps a register for friction in its own machinery, split from product debt by subject, where every item must name an owner and a written trigger — “later” is not a trigger — and closed items leave in the session that closes them, so the file’s size is a live measure of unaddressed friction. For an organization it’s the practical shape of exception management: an agent may propose a control, but a human-governed register decides whether it’s built, who owns it, and what moment fires it. Post 7 is the full account.

One team agreement from the same period belongs beside the ceremony ruling above: never optimize the human touchpoint count in either direction. A retrospective was about to report a fall from roughly eleven touchpoints to eight as a win. A factory that drives that number down excludes the operator; one that drives it up manufactures ceremony. Report it as an observation and rule on each touchpoint on its merits. Its sibling agreement from the same retrospective is the register’s own immune system, and it belongs here too: answering a process failure with a new process is the disease, not the cure.

Final Thoughts

If you own delivery in an organization that answers to auditors, the pitch of this whole series compresses to one inversion: agentic development doesn’t lower your governance bar — it’s the first delivery model where meeting the bar is cheap, because the evidence writes itself. Machine-readable registers instead of tribal knowledge. Driven-red records instead of “we have a test for that.” Gate classes declared before code instead of justifications after. Telemetry instead of memory. The scarce resource left is the one thing that was always scarce: qualified human attention — so spend ceremony only where it produces artifacts that attention actually reads.

This closes the initial six posts, but not the series — the factory hasn’t stopped, the epics keep shipping, and the hub’s promise stands: these are running totals, live documents, and there’s more to tell. If you’re arriving here first, start at the hub — and if you only take one artifact from the whole experiment into your own organization, take the deviation register. It’s the one your auditors will recognize on sight.