Stewardship Engineering: How Agents Earn Autonomy
Getting an AI agent to act is the easy half. Leaving one running for months, unattended and accountable, is the hard half. Here is the discipline, the mechanism it turns on, and the system I run it on.
Getting an AI agent to act is the easy half now. Getting one you can walk away from is not.
Right now everyone thinks the loop is how you walk away. Put an agent in a while loop, let it run overnight, read the diff in the morning. Claude Code and Codex ship it as a button, the creator of Claude Code calls loops as big a step as agents themselves, and TechCrunch says the AI world is getting loopy.
The loop is real. But it only buys you unattended execution. It says nothing about unattended authority. It runs a reckless action as faithfully as a careful one. What the loop is allowed to do at 3am, and how it earns more, is the unsolved part.
Mitchell Hashimoto named the easy half: harness engineering. You fix the agent's environment so it acts right while you watch. I'd been doing it for a while before I had the word.
Then I stopped watching. That is when the real questions start. What is it allowed to do at 3am? How do I know it is earning trust, and not just sounding confident? What survives the machine it runs on dying?
Those are not model questions. They are operations questions. I had been answering them one project at a time, never seeing they were one thing.
So I named the thing. Stewardship engineering. Running an AI agent as a custodian of your work. Bounded authority on your behalf. Accountable for what it does. Keeping what you hand it, over time.
The climb
Everyone using these tools is climbing the same ladder. Most have not drawn it.
Four disciplines. Six rungs. Rungs one and two are prompt and context engineering, where you talk to the model and feed it what it needs. Rungs three and four are harness engineering, Hashimoto's term, where you build the agent its tools so it can act. Rungs five and six are the ones I am naming. Stewardship engineering. You run it unattended, then you make it self-improving.
The line that matters is not a rung. It is the gap between rung four and rung five: the moment you stop watching.
Below that line, a mistake is an output you catch. Above it, a mistake is an action nobody caught. Everything here is about making that line safe to cross. Watch the gauge on the right edge: it only fills as the agent earns it.
The keystone: earned autonomy
When nobody is watching, one question rules: should it be allowed to do more? That hides two. What may it do on its own, and what still needs me in the loop? And how does a kind of work ever move from the second list to the first?
The answer cannot come from how confident the agent sounds. Models are fluent liars about their own work.
So I make trust testable. Before any real action, the agent writes a prediction it could be proven wrong about. A claim. The exact command that checks it. A baseline. A horizon. It all goes to an append-only outcome ledger, and later a deliberately dumb verifier runs the check and marks it true or false. The verifier holds no opinion. The judgment sits upstream, in choosing what to predict, which is exactly where it belongs. In the open. On the record. Not buried in a model grading its own homework.
The verifier is not always code. For a draft or a judgment call, the check is me: a card on the cockpit board (the shared kanban board I review), an approve or a reject, logged as the verdict the same way a passing test is. Deterministic checks settle the mechanical claims, the board settles the soft ones, and both land in the same ledger.
This is the piece I am proudest of, and the one I cannot find named anywhere else. The outcome ledger. Not the agent logging what it did, and not a human approving each step. The agent makes a checkable bet before it acts, then lives with the verdict. That is the difference between "trust me" and "here is the bet I made, and here is whether it paid."
One bet has already gone the wrong way. An earlier draft of this essay claimed the system ran in daily autonomous operation. The ledger settled that prediction as failed, so the sentence came out. That is the mechanism working on its own author.
In an enterprise system, the verifier needs somewhere to stand. The outcome ledger is not itself the source of truth; it is only the record of what was claimed and what settled. The truth lives in the systems that run the business. Reality may be a test suite, a CRM record, an ERP transaction ledger, or an operational database. The probabilistic system proposes; the governed operational system settles.
Authority is meant to become a live meter, never one global score. The ledger scores per task; the meter is designed to read those scores per task-class, and per model. Which model does the work matters. One model can earn the latitude to draft and research unattended while another has not. The same model can be trusted to draft while still gated on anything that spends money. It is designed to widen when predictions hold and narrow the instant they slip. Today it runs in shadow mode. It scores every prediction, including for work already running unattended, but it does not yet move a single permission. Autonomy is not a door you pass through once. There is no certificate to bank. I have built the apparatus. What it has is a few months of record. That honesty is the point, because a discipline about earned trust cannot open by claiming trust it has not earned.
Here is the soft spot, before you find it. The judgment moved upstream. It did not vanish. An agent could learn to predict only what it knows will pass, so the meter inflates while the real risk goes unmeasured. Teaching to the test, for agents. The first guard is in the open code now. A prediction that looks picked to be easy gets flagged before it counts. Keeping those predictions load-bearing is still the open problem under the open problem. The meter is necessary. It is not sufficient.
The system, shown
These primitives work no matter whose agent you run. Here they are, with honest status. The gap between "designed" and "running" is the whole game. Most are applications of patterns other people named, and I will say so. The new part is the outcome ledger above.
Want to look under the hood? The code is open. The umbrella repo connects the three public pieces: heartbeat for the loop, RightModel for routing and trust, and Anamnesis for memory.
| Primitive | What it is | Status |
|---|---|---|
| The envelope | A blast-radius boundary that earned autonomy widens over time | running, drawn conservatively today |
| The outcome ledger | Agent-authored predictions, settled by a dumb verifier, feeding a trust meter that still runs in shadow mode | running continuously, nearing a thousand logged predictions |
| Memory in custody | Knowledge durable across sessions, not re-explained each morning | repo, essays (genesis, resilience) |
| Cost-tiered loop | A cheap gate every cycle, an expensive model only when there's real work | repo, running |
| Model routing + council | RightModel picks the right model per task (data taint, availability, capability, cost) and convenes a council for load-bearing calls | repo, router running; council matured into a standing panel |
| State in git | The agent's whole working state as plain files, committed every cycle | running; pipeline builds and verifies from git |
Four are worth a closer look.
The envelope. A boundary around what an unattended cycle may do, with blast radius treated as a first-class property of every action. Today I draw it tight. Reversible actions run free: branch, draft, research, write to its own notes. Irreversible ones get staged for me: deploy, spend, message a person, touch real data. But "irreversible equals human" is just where the meter sits now, not the end state.
The whole promise of earned autonomy is that this line moves. As the ledger holds, the agent graduates to bigger actions on its own, and the line snaps back the instant the record slips. The goal is not a wall that leashes the agent forever. It is an envelope that widens to exactly what has been proven safe, and no further. "Autonomous" and "unsupervised" turn out to be different words, and the distance between them is what gets earned.
How does the line move if the agent never runs these unattended? It does not have to. In the human-in-the-loop phase, the agent still predicts, my approve-or-reject is the verdict, and the outcome is the check. A class graduates once its proposals have matched my calls often enough: first I engineer it to be recoverable, then I canary the genuinely irreversible, always one miss from snapping back. The measurement side of that exists in code. A shadow mode compares what the system would have picked against what it actually did, and only flags a model-and-class pair for graduation once their agreement holds. It is not yet what moves the line. Reversible work already runs unattended, many times a day, because the envelope allows it, not because it graduated. Irreversible classes are meant to climb the same ladder, one earned step at a time.
Model routing, and the council it powers. Not every task should go to the same model, and load-bearing calls should not go to just one. So model selection is its own substrate. I call it RightModel. It routes each task by a strict cascade: taint first (how sensitive is the data, and which models may see it), then availability, then capability, then cost. For high-stakes calls, it convenes a council of models with a synthesis judge and hard budget rails. Combining several models into one answer stronger than any of them alone is the idea behind my own council, and Sakana's Fugu and OpenRouter's Fusion are the same instinct at lab scale. Multi-provider on purpose, because the known trap of multi-agent debate is identical models talked into different personas, agreeing wrongly together.
Routing is also where earned autonomy lives. The per-model, per-class meter from the keystone is meant to hang off these decisions: RightModel picks the candidate, and the record should decide how much rope it gets. Today that record is measured, not enforced. Trust levels are still set by hand.
The router keeps growing past model selection. What started as picking a model is becoming something bigger. Now it also picks the vehicle that does the work. A live session. A background worker. A scheduled run. Each one carries an explicit contract: can it substitute another mid-task, or not. That piece is underway, not finished.
The cost-tiered loop. Always-on cannot mean always-expensive. This is the cascade idea from FrugalGPT, pointed at a loop that never stops. A cheap, deterministic gate runs every cycle, does no reasoning, and just checks ground truth. Most cycles end right there, for almost nothing. Only the rare cycle with real work escalates to a capable model. An agent that never sleeps lives or dies on that split.
State in git. The plainest piece: the agent's durable configuration and task state live as plain files in git. But when background agent fleets scale, committing high-frequency operational telemetry into git causes catastrophic commit churn and merge gridlock—for how we moved operational telemetry out-of-band to zero-churn edge databases, see Zero-Churn Repository Custody. Recovery from total hardware loss is simple. Clone the repo. Relaunch the loop. That is GitOps, pointed at an agent's working memory instead of its config. It is the least novel thing here, and one of the most useful. The real test is still ahead: the system using its own work-tracking to build its next version, the way a compiler compiles itself.
The claim
The field spent two years learning to make agents act. The next stretch is not a smarter model. It is learning to steward the ones we have, to run software as a custodian of someone's work: accountable, recoverable, and only as autonomous as it has earned.
So I went looking. Who had already named this? In fragments, plenty of people. The Knight First Amendment Institute frames autonomy as a designed level for a specific operating envelope, not an open-ended capability. Vibhu Bhatnagar formalized performance-gated autonomy tiers for enterprise agents. Operating agents as a discipline is becoming AgentOps. Cheap gate, expensive escalation is FrugalGPT. The council is multi-agent debate. State in git is GitOps. Even "earned autonomy" is already a phrase in circulation. If I had claimed none of this existed, you would be right to close the tab.
Two things still look unclaimed. The first is the synthesis. I cannot find anyone who put delegated authority, custody of work, revocable autonomy, and month-scale unattended operation into one discipline, instead of separate literatures you assemble yourself. The second is the mechanism: an agent committing to a falsifiable prediction before acting, an independent verifier settling it against operational reality, and that outcome governing future authority per model and task class.
The closest cousins sit in two places. In robotics, ET-GOA predicts, verifies, and adjusts autonomy, but off internal probability distributions rather than verifiable claims committed in the open. In governance, frameworks like the Knight Institute's certify a maximum designed autonomy level for a defined configuration and operating environment. That is vital for compliance and boundary definition. The meter here is designed to be operational rather than certificatory: authority should keep moving with the recent record. Today it measures. It does not yet move anything.
Every's eight levels of AI adoption is still the closest map. Worth reading. But it charts where you sit. This is about how you would ever earn the right to move.
Naming a discipline before proving it out is a bet. The self-rebuilding system is the part I still owe; if it never ships, this was a flag I planted and did not earn. But if you are running an agent unattended for longer than a session, you have already hit these problems, named or not. That is the point of giving them a name.
I did not set out to name a discipline. I set out to build an autonomous agentic system I could trust. The name came after, the way names should.
References
- Harness engineering: Mitchell Hashimoto, My AI Adoption Journey.
- Levels of autonomy, and certifying designed autonomy boundaries: Feng, McDonald & Zhang, Levels of Autonomy for AI Agents, Knight First Amendment Institute (arXiv:2506.12469).
- Performance-gated autonomy tiers: Vibhu Bhatnagar, Trust-Earned Autonomy for AI Agents (arXiv:2605.08912).
- Operating agents as a production discipline: AgentOps: Enabling Observability of LLM Agents.
- Cost-tiered cascades: Chen, Zaharia & Zou, FrugalGPT.
- Multi-model councils: Du, Li, Torralba, Tenenbaum & Mordatch, Improving Factuality and Reasoning in Language Models through Multiagent Debate.
- Combining models into one stronger answer: Sakana AI, Fugu; OpenRouter, Fusion.
- The closest cousin, robot self-assessment that adjusts autonomy: Conlon, Ahmed & Szafir, Event-triggered robot self-assessment (ET-GOA), Frontiers in Robotics and AI.
- Adoption levels as a map: Taylor & Entis, The Eight Levels of AI Adoption, Every.
- The loop moment: The AI World Is Getting Loopy, TechCrunch; and Anthropic's Ralph Wiggum plugin for Claude Code.