What the intelligence is allowed to see, touch and change is declared outside it. Swapping what sits in the slot does not move that line.
AI workers finish the work. I‑Ops ensures they do it right.
A runtime that works out what a task needs before it starts, governs anything consequential it tries to do, and then checks the result against conditions written before the run by something that is not the worker. It runs on your machine by default.
Before anything runs, the conditions are written down.
Not by the worker. Conditions it cannot see and cannot edit are the only kind worth checking against afterwards.
- must coverevery account in the granted folder
- must traceevery figure back to a named file
- must notwrite anything outside the granted folder
“Done. Summary written, twelve accounts covered.”
This is the sentence nearly every tool stops at. It is the worker grading its own paper, and it is usually true enough to be believed.
- statuscompleted without error
- output1 file written
- reported bythe worker
Three accounts were never opened. The summary did not mention it.
The check reads the world back rather than the worker’s account of it, and it is computed by code. Swap the model and the same shortfall is found.
- in folder14 accounts
- opened11 accounts
- never opened3 accounts
- figures traced11 of 11
- written outside0 files
/01 the problem
More capable is not more accountable.
Model capability has moved faster than anyone’s ability to show that a piece of work was actually done. Those are two different problems, and only one of them is being solved.
What got better
- Reasoning, tool use, and how long a model can stay on a task without losing the thread.
- How much a single run can produce before anyone looks at it.
- How confidently the finished work reads, whether or not it is right.
What did not
- Whether the work can be shown to be complete, by anything other than the thing that did it.
- Whether a person can tell a finished task from a task that merely stopped.
- What happens when it is wrong, which is no longer a bug in a file nobody shipped.
Two years ago a person read what the model produced, and the worst case was a bad draft. Now a single run writes more than anyone reads. Guardrails went up. So did the size of the mistake. Those are not the same axis.
/02 why governance
The work is the easy half.
Access is not assurance. Neither is a run that finished without an error. A task can touch the right systems, take every step it was asked to take, report success, and still have left out the part that mattered.
The worker does not get to declare its own work finished.
What that means in practice
- The conditions for done are written before the run, by code the worker never sees.
- The check re‑reads the world afterwards. It never asks the worker how it went.
- Evidence is counted, not claimed. What was opened is a fact, not a summary.
Why it holds
- Every check is arithmetic over what happened, so it does not depend on which model ran.
- A better model makes the work better. It does not make the guarantee weaker or stronger.
- Limits are enforced by code rather than instructions, because a limit a model can talk its way past is a suggestion.
/03 the intelligence
The intelligence is a slot, not the product.
Something has to do the work. What that something is will keep changing, and betting the company on one answer to that question is how you end up rebuilding when the answer moves. So the runtime treats intelligence as a component with a defined edge, and holds its guarantees from outside it.
We ship one, called Vinci. It runs on your machine, reads only the folders you grant, proposes before it changes anything, and leaves a record. Using it is not a requirement and never will be. Bring a frontier model, a small local one, a team’s own agent, or whatever exists in two years. The checks do not care, because they were never computed by the thing being checked.
the edge is defined
folders, not systems
You grant a folder. That is the boundary, and it belongs to the runtime rather than to whatever is doing the thinking. Nothing widens it quietly.
proposes, then acts
Anything that changes the world is shown first as a diff, held for approval, and recorded in a way that can be undone. That is enforced by the runtime, not requested of the model.
local by default
Vinci runs on your machine. A different model can run elsewhere if you configure it, and every run records the posture it actually ran under.
honest about depth
How much can be held depends on how deeply the intelligence is integrated. The runtime states which guarantees apply rather than claiming all of them.
nothing is sent
No content leaves the machine except to endpoints you configure. There is no default‑on telemetry carrying your work.
/04 authority
Workers act inside your rules.
Most of what goes wrong with an agent is not a wrong answer. It is a correct answer assembled out of things the person asking was never allowed to see.
The rule that cannot bend
Gathering context must never raise the permission of whoever started the task. Not through another worker, not through a colleague, not through a summary, and not through an answer derived from any of them.
When a task genuinely needs something out of reach, the task moves to someone who can own it. The answer does not quietly come back anyway.
What that prevents
- An agent turning a narrow permission into a broad one by asking the right question twice.
- A summary laundering a confidential source into a sentence anybody may read.
- A budget, retry cap or spending ceiling being negotiated away in conversation.
/05 what it does
Six things, and none of them is the model.
Every one of these is computed by code. That is what makes them survive a change of model, and it is the difference between a feature and a guarantee.
/01 context sufficiency
Know what is missing before you start.
The runtime works out what the task needs, names what it does not have, and says which permission would close the gap. A run that cannot be done properly says so at the start rather than at the end.
/02 evidence coverage
What was actually read.
Not what the worker says it read. Coverage reports observations rather than conclusions, so it will tell you a file was never opened and will not tell you the file was missing.
/03 consequence gates
Nothing consequential happens quietly.
Anything outward facing is predicted as a diff, held behind one approval, and made reversible before it runs. Nothing in the product can send on your behalf.
/04 independent verification
The world is re‑read afterwards.
Conditions declared before the run are checked against the world after it, by something that never spoke to the worker. A condition nobody could check is reported as unchecked, not as passed.
/05 enforced budgets
Limits that cannot be argued with.
Steps, retries, spend and wall clock are enforced by code. A model may reason about a budget. Only code gets to hold one.
/06 the record
Afterwards, you can read what happened.
Every decision, every refusal, every approval and the posture the run executed under. Durable, because an incident is the definition of something read back later.
/06 how it works
One task, six moments.
/01
Declare
What would count as done is written down before the first step, by code rather than by the worker. Nothing else in the run gets to edit it.
/02
Assess
The runtime works out what the task needs and what is not available. Gaps are named in plain language, with the permission that would close each one.
/03
Acquire
Missing context is gathered under the permissions of whoever asked, never under anyone else’s. When that is not enough, the task escalates rather than the answer.
/04
Execute
The worker does the work inside enforced limits. Anything that would change the world is predicted, held, and made reversible before it happens.
/05
Verify
The world is read back and compared to what was declared in step one. The worker is not consulted, and its own report is not evidence.
/06
Report
You get a state, not a score. Complete, incomplete, refused, or waiting on an authority that is not yours to give, and the evidence behind whichever one it is.
/07 early access
It is early, and it is real.
Signed, notarised builds run on macOS today. Early access is a conversation rather than a download queue, because the useful version of this is the one shaped around work you actually have.