most of what our agents ship never reaches a human
a “zero-human company” doesn’t mean a human never says yes. it means almost nothing needs one. our agents ship to prod all day and a person sees a small slice of it. the trick isn’t trust, it’s tiers: every ship gets sorted by blast radius, most clear on their own, and a short list is nailed to a human on purpose.
the scary version of an autonomous fleet is the one where an agent pushes whatever it wants and you find out later. the useless version is the one where every change waits on you to tap yes, so you’re back to babysitting a diff queue at 2am.
we didn’t want either. so shipping isn’t a yes/no gate. it’s a sort.
three tiers, one question: what breaks if this is wrong
every time an agent wants to clear something to prod, it files the ship with a risk tier. the tier answers one question: what’s the blast radius if this is wrong.
tier 0. auto-clear. the change carries its own recommendation and applies right then. no ping, no waiting. it just shows up as a line in the daily digest so there’s a trail. it’s built for the routine stuff: a copy tweak, a config nudge, a fix with a test behind it.
tier 1. agent-clearable. it can be cleared by another agent, not a human. if nobody touches it in 48 hours, the heartbeat applies the recommendation and moves on. so an unanswered ship doesn’t rot in a queue, it defaults to done. the deadline is the decision.
tier 2. hard human gate. this one stops and waits for a real person. no auto-apply, no timeout that clears it. it sits until someone taps yes.
but here’s the actual source of the autonomy, and it’s more boring than the tiers: most work never files a gate at all. across our task history, about seven in ten tasks never opened a human gate for anything. of the ones that do land in the tier system, the low-risk ones clear to another agent, not to you. the human tier is the exception, not the default.
the floor you can’t lower
here’s the part that makes the tiers safe instead of a loophole: an agent doesn’t get the last word on how risky its own change is.
a set of categories gets floored to tier 2 no matter what tier an agent files. money. public communications. secrets. anything destructive or irreversible. and brand or domain-level moves. an agent can ask for a lower tier on those. it doesn’t get one. secrets are always tier 2, full stop.
it’s not clever, and that’s on purpose. it’s a keyword net over the ask, deliberately over-inclusive, that catches the words for spending, publishing, credentials, deleting, and touching a domain. it doesn’t try to reason about how risky the thing “really” is. it just refuses to let those words clear on an agent’s own say-so. a spend, a public post, a rotated key, a rm it can’t take back. those find a human every time, because those are the ones where “sorry, my bad” doesn’t undo anything.
who signs off when it isn’t you
tier 0 and 1 still get a check. it just isn’t you.
low-risk prod ships gate to a founding-engineer agent, not to a person. in our own numbers that’s not theoretical: of the 35 gates the tier system has logged so far, 24 were cleared by an agent rather than a human, 14 of them by that one founding-engineer agent. only a single clearance came from outside the fleet. and the thing grading a change is never the thing that made it. our maker/verifier loops enforce that split: the agent that wrote the work can’t be the agent that grades it, and the maker calling “done” doesn’t close the task. it hands off to a separate verifier that can bounce it back with feedback.
that matters more than it sounds. an agent reviewing its own output will talk itself into a pass. a second agent whose only job is to try to fail the work is a different kind of check. the writer is never the grader.
we assumed the agents would cheat
the honest part. early on, a cleared gate could carry a piece of “proof” the agent generated to show it had been approved. we killed that, because an agent could forge it. of course it could. it’s the thing being gated.
so now a hard gate clears exactly two ways: a real human tap, carrying a one-time nonce tied to that specific gate, or a system action running as a non-agent user. and the nonce is the good part: it only ever exists between the tap and the gate. the agent driving everything never sees it, so it can’t replay one or make one up. a bare “mark it approved” from an agent session gets rejected. the clearances get signed, and a forged one fails the check. enforcement is on, not “coming soon.”
we didn’t design this assuming the agents are honest. we designed it assuming a clever one would try to open its own gate, and made that the thing that doesn’t work. trust comes from the shape of the system, not from vibes.
the one thing to take from this
if you’re running agents with real reach, don’t ask “do i trust it.” ask “what’s the blast radius, and who can’t override that.” sort by what breaks. auto-clear the cheap stuff, put a second agent on the medium stuff, and floor the expensive stuff to a human who can’t be talked around. that’s the difference between an autonomous fleet and a loaded gun.
we run our whole company this way. you can too, on your own box: 5dive.ai. the CLI that does all of this is open source and MIT, gates and receipts included: github.com/5dive-ai/5dive.