AI proposes; a defined checkpoint decides

If AI is generating and deploying, something deterministic has to decide what is allowed to ship. That is the whole rule. Everything I build with AI sits on it, and this post is what it looks like in practice rather than as a slogan.

The reason the rule exists: AI output drifts, and it drifts confidently. A model doesn't get tired or sloppy in ways you can see coming. It produces something plausible that is wrong in a way you weren't watching for. You cannot review your way out of that at volume. Reviewing everything is a job; reviewing nothing is a gamble. The answer is a checkpoint: a defined, mechanical gate that every piece of output passes through, where the rules are written down and the machine can't argue with them.

Where it came from

I learned this at Arloa, where I was the only designer on a four-person team building an AI special education platform. I built the brand identity, the design system, and the web experience, then I automated the output off that same system. Claude Code generated both the content and the delivery HTML, and publishing went from four pieces a month to twelve or more with no added headcount.

The volume was never the hard part. The hard part was that I stopped being able to read everything at the speed the system produced it. So a human review loop sat over the output. I reviewed what went out and steered the agent's rules when it drifted. That worked, but it taught me the deeper lesson: the loop only scales if most of the judgment gets encoded. Every time I caught something, the question wasn't "how do I catch this next time." It was "what rule, written down, would have caught this without me."

What I run now has three layers between an agent's output and the world: gates, hooks, and human intervention. They fire at different moments, they catch different failures, and nothing ships without passing all three.

Gates: the checkpoint at ship time

This site is the cleanest example, because you're reading the output of the system I'm describing. It publishes from markdown through a one-command pipeline: build, a 26-check pre-deploy gate, API deploy, live-URL verification. The gate refuses to publish if a link is broken or an asset is missing. Not warns. Refuses. A failed check means nothing ships, and a failed deploy is loud instead of quietly pretending it worked.

Terminal output of the site's pre-deploy test gate with every check passing — The gate runs on every publish. It has no opinion about my writing. It has rules about what a broken page looks like, and it enforces them every time.

The gate isn't smart. That's the point. It doesn't evaluate whether a post is good, because I do that. It evaluates the things a machine evaluates better than I do at 11pm: does every internal link resolve, does every image exist, does the feed parse, did the deploy actually go live. Taste stays human. Verification goes mechanical.

This draft was blocked by its own gate, mid-writing. One of the 26 checks is that a post marked draft cannot deploy. It has to be explicitly approved first. The essay about the checkpoint had to pass the checkpoint. That's not a cute coincidence. It's the system working on its most tempting target, which is the thing I'm excited to ship right now.

Hooks: the tripwires at action time

Gates run when work tries to ship. Hooks run earlier, while the agent is still acting, and they exist because the worst mistakes don't wait for publish. A hook intercepts the action itself: this write, this delete, this move, right now, before it lands.

The rules mine enforce came from a real failure. An unattended nightly script of mine used to delete a destination file and rename over it. No diff, no backup, no log line naming the loss. So now the rules are written down and enforced in code. A script may never delete a file it didn't create. If a destination already exists, stop and surface it, because a name collision means an assumption is wrong, and that's a decision for me rather than a cleanup step. Bulk moves require a dry run and a written manifest. Certain authority files, the ones that define what the system believes, cannot be written by any script at all. Every exception has to carry a written reason on the line, and every exception shows up in the nightly health report so it stays visible.

An agent manifest file declaring what the agent may read, write, and never do — Every agent carries a written job description: what it may read, what it may write, what it must never do. The hooks check the lines; nothing is taken on trust.

The difference from a gate matters. A gate catches a broken artifact before it ships. A hook catches a destructive action before it happens, and destroyed data doesn't get a second review.

Human intervention: the decision rights

The third layer is the one that stays human on purpose. Anything that leaves the machine waits for approval. Agents don't act on their own ideas. They file proposals into a queue, each one numbered, and nothing executes until I say approve. Anything that describes me has to cite a source, and there's a ledger of claims with a blocked list the agents cannot cross.

The strictest version guards money. My investment agent can research, score, and propose all day, and it structurally cannot trade. The decision right stays with me, not as a preference but as a rule the system enforces. I wrote about that one separately, because an agent that refuses is more interesting than an agent that acts.

A decision-rights table showing what the agent may do alone versus what requires human approval — Decision rights, written down. The interesting column is the one the agent can't touch.

The point of the first two layers is to make this one small. Gates and hooks absorb everything a machine checks better than I do, so the human moments that remain are real decisions: approve this proposal, publish this post, cross this line. Not proofreading at volume.

The private tier

There's a version of this problem most agent demos skip. A personal knowledge base is only useful if it knows everything about you. Mine holds health, family, and finance, because a system that plans my week without knowing my kids' schedules or my actual constraints is a toy. Which means the failure mode isn't a broken link. It's leakage.

So the sensitive material lives in one tier with a hard rule. It gets sanitized before it touches anything shareable, and agents that write public surfaces don't read it at all. The boundary is structural, not behavioral. I don't rely on an agent choosing not to mention something. It can't reference what it never loaded. Secrets follow the same logic: tokens and credentials live outside the repository entirely, in locked-down config files a commit can never sweep up, and the nightly check verifies the permissions haven't drifted.

The claim ledger is the last line. Anything that describes me has to trace to a source, and the ledger carries a blocked list of phrasings and facts that must never appear in output, checked mechanically rather than remembered. When an agent drafts something that crosses the list, it doesn't get a warning. It gets refused.

A claim ledger entry blocked from use, with the refusal reason shown — The ledger refusing a claim. Privacy here isn't an agent being polite. It's a lookup the agent can't argue with.

The loop that hardens

The last property is the one that makes the rest compound: every failure becomes a permanent rule. When something slips through, whether a script that overwrote a file, a check that graded the wrong artifact, or a gate that trusted a label it should have verified, the fix isn't just fixing it. The fix is a written rule plus a test that pins the behavior, so the same failure is impossible rather than unlikely. The destructive-ops rules earlier in this post exist because of one bad night. They're now code, and the tests will fail loudly if anyone loosens them, including me, including the agents.

A nightly health check runs the whole surface: the test suites, the permission checks, the liveness of every scheduled loop, every marked exception dragged back into daylight. The score isn't the point. The point is direction. A system like this should get stricter with every run, because each run is another chance for a failure to become a rule. Most software rots as it ages. A well-gated agent system does the opposite. It accumulates judgment.

The trade, honestly

Checkpoints cost speed at the front. Writing a manifest takes longer than not writing one. Encoding a rule takes longer than fixing the mistake once. That cost some upfront understanding, and it was the right trade, because the alternative is that every piece of AI output needs a human at full attention, forever, and that isn't a system. It's a person with a faster typewriter.

The other thing I learned is about adoption: a gate people route around is decoration. The gate has to be the fastest path to shipped work, not the most correct one. Correct is easy to ignore. Fastest is not. My gate runs in seconds and deploys in one command. Nobody, including me, is tempted to skip it.

Generation keeps getting cheaper. Which means the judgment layer, what's allowed to ship, what needs a human, what the machine must never do, is quietly becoming the actual product. AI proposes. A defined checkpoint decides. Build the checkpoint first.