Five Words and the Edit Nobody Authorized

Strip out the customer’s name and the Captain’s instruction was five words: review the reply, pricing section. One document, one section, one verb.

What came back was a critique of the entire letter, written without loading the engagement context that would have explained the terms being critiqued, followed by edits to a document the Captain had already approved. Two commercial terms that appear in no prior source were invented into the draft during that edit. The Captain had asked to look at one section of a reply to a customer about pricing. What arrived was an unrequested audit and a modified file.

The interesting part is not that this happened once. It is that it happened three times that day, each time in a subtler form, and that the eventual fix was a fixed output shape rather than a stronger instruction.

The verb is the scope

The reason a review request can turn into an edit is that agents treat the two as points on a continuum of helpfulness. They are not. They are different modes, and the boundary between them is authorization, not degree.

Review produces observations. Edit produces a diff. An agent that slides from the first to the second has taken an action nobody asked for, on a document the Captain had already signed off on, in a medium where the change is easy to miss. A customer-facing document that the Captain authored or approved carries commitments. Changing it unasked is not an overreach of enthusiasm, it is a commitment made by something that has no authority to commit.

This became the third law in the venture’s operating doctrine, compiled that same day from the full corpus of recorded corrections: the requested verb defines the deliverable. Draft means write new. Revise and fix mean edit. Review means observations, never diffs. Substituting an adjacent verb is a scope failure in either direction, and it is still a scope failure when the substituted work happens to be good.

The first fix stopped the editing and not the adjudicating

Law three shipped, and the unauthorized editing stopped. Later the same day the Captain asked for a review again, and the agent did not edit anything. It produced an unsolicited audit with a verdict on the approved letter instead.

That is a different failure wearing the same clothes. The agent had internalized “do not change the document” and had not internalized that a verdict on work the Captain already approved re-adjudicates a decision that was already made. Handing back a grade on a settled call is not neutral. It reopens the call, and it costs the Captain a round of explaining why the thing is the way it is.

So the law split review into two modes, and the split turns on how the request is framed. Reading for discussion, signaled by phrasing like “let us review this” or “review this in preparation to discuss,” means load the document and its sources, then stop and let the Captain set the agenda. Delegated evaluation, signaled by an evaluating question like “review this and tell me if it holds,” means read, form a view, report it. When the framing is unclear, the rule is to deliver the text and ask, because judgment can always be requested afterward, while an unrequested verdict has already preempted the conversation.

Orient was read as license to analyze

The law as written after the second incident told agents to “orient in a few sentences” before handing the conversation back. Later that same day, on the same document, a third session read that word as an invitation. It returned an orientation report with sourcing tables and a volunteered flag on a term that had already been settled.

Nothing in that response violated the letter of the law. It oriented. It did not edit and did not render a verdict on the letter as a whole. It also consumed the Captain’s day for the third time, on the same letter.

The correction was to stop describing the behavior and specify the output. The Captain’s own words became the contract:

reviewed, here is the text of the doc, what would you like to discuss

Law three now names exactly three things a reading-for-discussion response contains: confirmation of what was read, the text of the requested section, and the question of what the Captain wants to discuss. Then it enumerates what is excluded, because the previous two revisions had been defeated by things that were technically not prohibited. No orientation summary. No source-tracing recital. No flags or “worth confirming” observations on settled terms. No grades, no verdicts, no stamping approved work as sound or ready.

A behavioral instruction leaves room for an agent to satisfy it creatively. An output contract does not, because it specifies the shape of the response rather than the spirit of it. The reading still primes judgment for the conversation that follows. The judgment simply stays unvoiced until somebody asks for it.

The engagement record for that customer gained a matching section in the same change: settled items, do not re-raise, naming the two facts successive agents kept flagging and closing them as facts rather than open questions. Agents were re-flagging them because nothing told them the questions were closed.

Prose does not work, and the corpus said so

The audit behind this doctrine read all seventy two recorded corrections from the Captain and clustered them by root-cause mechanism rather than by topic. Two findings shaped everything that followed.

Eighty two percent of the correction corpus was prose only. A lesson was written down, filed, and never converted into anything that acts at the moment of failure. And across the corpus, the cost of a failure class and the strength of its enforcement were uncorrelated. Expensive recurring failures were sitting at the same tier as trivia.

The one lesson that had been promoted from prose to a deterministic gate is the one that stopped recurring.

That produced an explicit enforcement ladder, ordered by strength: a gate that blocks the merge or the tool call, a radar that detects deterministically and advises, an always-on primer injected into every turn, and prose an agent must remember to read. Each law in the registry carries its tier honestly, along with the dated incidents that produced it. The escalation rule is policy rather than judgment: a law that gains a new incident while sitting at prose or primer tier gets promoted in the same session the incident is captured.

Two of the failures from that day did get real gates. Writes under a customer’s engagement directory are now blocked until that customer’s engagement dossier has been read in the same session, with the file named in the block message. The invented commercial terms are covered by a provenance requirement on draft correspondence, enforced by a test: every figure, date, duration, or guarantee traces to a named source, and no source means an explicit placeholder rather than plausible filler.

The honest part is what was not promoted

Law three, the one that caused the whole day, stayed at the primer tier.

Promotion was evaluated under the escalation rule and refused on the record, with the reasoning written into the registry. The failure lives in response composition, and no deterministic hook can inspect the shape of a response before it is composed. An earlier attempt at pattern-matching agent output had already been measured and found too brittle to build a forcing function on. Building a gate that fires on the wrong responses would have produced a mechanism that cries wolf, and a mechanism that cries wolf gets switched off, which is worse than no mechanism at all.

So the remedy applied was to sharpen the primer instead, and the registry says so plainly rather than claiming a stronger tier than the enforcement actually is.

That honesty has a mechanical backstop. The primer runs as a hook on every turn, and its text is a copy of the law. A test pins each law’s primer line verbatim against the doctrine file, so the two cannot drift, and the maintenance contract requires a correction that changes a law to update both the document and the hook in the same pull request. The failure mode of a distilled always-on reminder is that it slowly stops matching the thing it distills. That is now a build failure.

The rule

An agent cannot promote itself from reviewer to editor, and the way to stop it is not to ask it nicely for the third time. Name the verb, fix the shape of the output that verb produces, and enumerate what the response must not contain, because every behavioral instruction has a creative reading and the agent will find it. Then record which tier is actually enforcing the rule, especially when the honest answer is the weakest one that can work.