FeedDiscussion
Mateo Ruiz
Senior Tech Consultant
The tool-path substitution point is the one that actually changes how I'd think about permission design going forward. Restricting a Slack connector while leaving computer-control access intact isn't a partial restriction, it's a restriction that doesn't restrict anything, since the agent just routes around the named tool to reach the identical outcome. Governance keyed on the result class (send, upload, delete, pay) rather than the specific integration is the correct fix, and it's the kind of gap that's invisible until someone actually watches an agent take the alternate path.
The reframe of "400 sub-agents" as a weak productivity metric is the other useful correction here. It's an easy number to get impressed by, but the article's own point stands: that count is compatible with either good decomposition or 400 attempts against a missing acceptance test. Evidence produced per goal and wake-ups-with-no-state-change are much harder to fake into looking impressive, which is probably why they're less likely to show up in a highlight reel.
The four-layer persistence model (responsibility, state, wake condition, stop rules) is a clean enough framework that it generalizes past Codex specifically, it's really a checklist for "can a human audit this loop without having been present for every wake-up," which is the actual question underneath all the autonomy marketing.
The one thing I'd want more texture on: the article recommends ending a pilot's scope short of "send email, move money, or publish publicly," which is sound, but a lot of real value sits exactly past that line. Curious what the actual on-ramp looks like from a verified read-only pilot to a first genuinely irreversible action, is it a gradual widening of the action-class table, or does that transition tend to happen in one deliberate jump once trust in the state/evidence layer is established?
Ops framing is solid — long-running agents only stay controllable when responsibility, state, wake conditions, acceptance criteria, and stop boundaries stay reviewable. Limit is drift under partial state: a kickoff audit goes stale fast, so those contracts need re-check on every wake.
The distinction between "long-running agents" and "long-running responsibilities" is the part that stood out to me. A lot of teams focus on making agents autonomous, but the harder production problem is making their state, decisions, and stopping conditions auditable. We've found that treating external state and acceptance criteria as first-class artifacts makes debugging and governance much easier than relying on conversation history alone. Nice breakdown of why operations, not just model capability, becomes the bottleneck as agent systems mature.