Stewardship Engineering: How Agents Earn Autonomy
Getting an AI agent to act is the easy half. Leaving one running for months, unattended and accountable, is the hard half. Here is the discipline, the mechanism it turns on, and the system I run it on.
Getting an AI agent to act is the easy half now. Getting one you can walk away from is not.
Right now everyone thinks the loop is how you walk away. Put an agent in a while loop, let it run overnight, read the diff in the morning. Claude Code and Codex ship it as a button, the creator of Claude Code calls loops as big a step as agents themselves, and TechCrunch says the AI world is getting loopy.
The loop is real. But it only buys you unattended execution. It says nothing about unattended authority. It runs a reckless action as faithfully as a careful one. What the loop is allowed to do at 3am, and how it earns more, is the unsolved part.
Mitchell Hashimoto named the easy half: harness engineering. You fix the agent's environment so it acts right while you watch. I'd been doing it for a while before I had the word.
Then I stopped watching. That is when the real questions start. What is it allowed to do at 3am? How do I know it is earning trust, and not just sounding confident? What survives the machine it runs on dying?
Those are not model questions. They are operations questions. I had been answering them one project at a time, never seeing they were one thing.
So I named the thing. Stewardship engineering. Running an AI agent as a custodian of your work. Bounded authority on your behalf. Accountable for what it does. Keeping what you hand it, over time.
The climb
Everyone using these tools is climbing the same ladder. Most have not drawn it.
Four disciplines. Six rungs. The bottom two are prompt and context engineering, where you talk to the model and feed it what it needs. The middle is harness engineering, Hashimoto's term, where you build the agent its tools so it can act. The top is the one I am naming. Stewardship engineering. You run it unattended.
The line that matters is not a rung. It is the gap between rung four and rung five: the moment you stop watching.
Below that line, a mistake is an output you catch. Above it, a mistake is an action nobody caught. Everything here is about making that line safe to cross. Watch the gauge on the right edge: it only fills as the agent earns it.
The keystone: earned autonomy
When nobody is watching, one question rules: should it be allowed to do more? That hides two. What may it do on its own, and what still needs me in the loop? And how does a kind of work ever move from the second list to the first?
The answer cannot come from how confident the agent sounds. Models are fluent liars about their own work.
So I make trust testable. Before any real action, the agent writes a prediction it could be proven wrong about. A claim. The exact command that checks it. A baseline. A horizon. It all goes to an append-only outcome ledger, and later a deliberately dumb verifier runs the check and marks it true or false. The verifier holds no opinion. The judgment sits upstream, in choosing what to predict, which is exactly where it belongs. In the open. On the record. Not buried in a model grading its own homework.
The verifier is not always code. For a draft or a judgment call, the check is me: a card on the cockpit board, an approve or a reject, logged as the verdict the same way a passing test is. Deterministic checks settle the mechanical claims, the board settles the soft ones, and both land in the same ledger.
This is the piece I am proudest of, and the one I cannot find named anywhere else. The outcome ledger. Not the agent logging what it did, and not a human approving each step. The agent makes a checkable bet before it acts, then lives with the verdict. That is the difference between "trust me" and "here is the bet I made, and here is whether it paid."
Authority becomes a live meter, never one global score. The ledger scores per task; the meter reads those scores per task-class, and per model. Which model does the work matters: one model can earn the latitude to draft and research unattended while another has not, and the same model can be trusted to draft while still gated on anything that spends money. It widens when predictions hold and narrows the instant they slip, including for work already running unattended, which keeps getting scored exactly like the rest. Autonomy is not a door you pass through once. There is no certificate to bank. I have built the apparatus, but what it does not have yet is a long track record. That honesty is the point, because a discipline about earned trust cannot open by claiming trust it has not earned.
Here is the soft spot, before you find it. The judgment moved upstream. It did not vanish. An agent could learn to predict only what it knows will pass, so the meter inflates while the real risk goes unmeasured. Teaching to the test, for agents. Keeping those predictions load-bearing is the open problem under the open problem. The meter is necessary. It is not sufficient.
The system, shown
These primitives work no matter whose agent you run. Here they are, with honest status. The gap between "designed" and "running" is the whole game. Most are applications of patterns other people named, and I will say so. The new part is the outcome ledger above.
Want to look under the hood? The code is open. The repo points at the two live pieces, the heartbeat loop and RightModel.
| Primitive | What it is | Status |
|---|---|---|
| The envelope | A blast-radius boundary that earned autonomy widens over time | running, drawn conservatively today |
| The outcome ledger | Agent-authored predictions, settled by a dumb verifier, driving the trust meter | running, track record accruing |
| Memory in custody | Knowledge durable across sessions, not re-explained each morning | running (how) |
| Cost-tiered loop | A cheap gate every cycle, an expensive model only when there's real work | running |
| Model routing + council | RightModel picks the right model per task (taint, availability, capability, cost) and convenes a council for load-bearing calls | router running; council wired, young |
| State in git | The agent's whole working state as plain files, committed every cycle | running; self-rebuild is the next proof |
Three are worth a closer look.
The envelope. A boundary around what an unattended cycle may do, with blast radius treated as a first-class property of every action. Today I draw it tight. Reversible actions run free: branch, draft, research, write to its own notes. Irreversible ones get staged for me: deploy, spend, message a person, touch real data. But "irreversible equals human" is just where the meter sits now, not the end state.
The whole promise of earned autonomy is that this line moves. As the ledger holds, the agent graduates to bigger actions on its own, and the line snaps back the instant the record slips. The goal is not a wall that leashes the agent forever. It is an envelope that widens to exactly what has been proven safe, and no further. "Autonomous" and "unsupervised" turn out to be different words, and the distance between them is what gets earned.
How does the line move if the agent never runs these unattended? It does not have to. In the human-in-the-loop phase, the agent still predicts, my approve-or-reject is the verdict, and the outcome is the check. A class graduates once its proposals have matched my calls often enough: first I engineer it to be recoverable, then I canary the genuinely irreversible, always one miss from snapping back. The measurement side of that is built. A shadow mode runs every routing decision twice, what the system would have picked against what it actually did, and only flags a model-and-class pair for graduation once their agreement holds. Reversible work already runs unattended this way, many times a day. Irreversible classes climb the same ladder, one earned step at a time.
Model routing, and the council it powers. Not every task should go to the same model, and load-bearing calls should not go to just one. So model selection is its own substrate. I call it RightModel. It routes each task by a strict cascade: taint first, then availability, then capability, then cost. For high-stakes calls, it convenes a council of models with a synthesis judge and hard budget rails. Combining several models into one answer stronger than any of them alone is the idea behind my own council, and Sakana's Fugu and OpenRouter's Fusion are the same instinct at lab scale. Multi-provider on purpose, because the known trap of multi-agent debate is identical models talked into different personas, agreeing wrongly together.
Routing is also where earned autonomy lives. The meter is kept per model and per task-class, so what the ledger really scores is a model-and-class pair: RightModel picks the candidate, the record decides how much rope it gets. A model that has not earned a class does not run it unattended, however cheap it is.
RightModel is about seventeen modules under test today. The router runs and the council is wired.
The cost-tiered loop. Always-on cannot mean always-expensive. This is the cascade idea from FrugalGPT, pointed at a loop that never stops. A cheap, deterministic gate runs every cycle, does no reasoning, and just checks ground truth. Most cycles end right there, for almost nothing. Only the rare cycle with real work escalates to a capable model. An agent that never sleeps lives or dies on that split.
The plainest piece: the agent's whole state lives as plain files in git, committed every cycle. Recovery from total hardware loss is simple. Clone the repo. Relaunch the loop. That is GitOps, pointed at an agent's working memory instead of its config. It is the least novel thing here, and one of the most useful. The real test is still ahead: the system using its own work-tracking to build its next version, the way a compiler compiles itself.
The claim
The field spent two years learning to make agents act. The next stretch is not a smarter model. It is learning to steward the ones we have, to run software as a custodian of someone's work: accountable, recoverable, and only as autonomous as it has earned.
So I went looking. Who had already named this? In fragments, plenty of people. The Knight Institute frames autonomy as a designed level, not a capability. Operating agents as a discipline is becoming AgentOps. Cheap gate, expensive escalation is FrugalGPT. The council is multi-agent debate. State in git is GitOps. Even "earned autonomy" is already a phrase in circulation. If I had claimed none of this existed, you would be right to close the tab.
Two things still look unclaimed. The first is the synthesis. I cannot find anyone who put delegated authority, custody of work, revocable autonomy, and month-scale unattended operation into one discipline, instead of four separate literatures you assemble yourself. The second is the mechanism, the outcome ledger: the agent writes its own testable prediction before acting, a dumb verifier settles it after, and the meter has nothing to bank.
The closest cousin I found is ET-GOA, from robotics. It predicts, verifies, then adjusts autonomy, but off internal probability distributions, not human-readable claims the agent commits to in the open. And it is the opposite of the Knight Institute's "autonomy certificates," which are issued once and held. Here there is no certificate. Only the recent record.
Every's eight levels of AI adoption is still the closest map. Worth reading. But it charts where you sit. This is about how you would ever earn the right to move.
Naming a discipline before proving it out is a bet. The self-rebuilding system is the part I still owe; if it never ships, this was a flag I planted and did not earn. But if you are running an agent unattended for longer than a session, you have already hit these problems, named or not. That is the point of giving them a name.
I did not set out to name a discipline. I set out to build an autonomous agentic system I could trust. The name came after, the way names should.
References
- Harness engineering: Mitchell Hashimoto, My AI Adoption Journey.
- Levels of autonomy, and the static "autonomy certificates" this argues against: Feng, McDonald & Zhang, Levels of Autonomy for AI Agents, Knight First Amendment Institute (arXiv:2506.12469).
- Operating agents as a production discipline: AgentOps: Enabling Observability of LLM Agents.
- Cost-tiered cascades: Chen, Zaharia & Zou, FrugalGPT.
- Multi-model councils: Du, Li, Torralba, Tenenbaum & Mordatch, Improving Factuality and Reasoning in Language Models through Multiagent Debate.
- Combining models into one stronger answer: Sakana AI, Fugu; OpenRouter, Fusion.
- The closest cousin, robot self-assessment that adjusts autonomy: Conlon, Ahmed & Szafir, Event-triggered robot self-assessment (ET-GOA), Frontiers in Robotics and AI.
- Adoption levels as a map: Taylor & Entis, The Eight Levels of AI Adoption, Every.
- The loop moment: The AI World Is Getting Loopy, TechCrunch; and Anthropic's Ralph Wiggum plugin for Claude Code.