The Operating Model: A Governed Multi-Agent System

Every organization adopting AI hits the same wall: one person with a prompt can be fast, but the moment agents start acting on real systems (sending, spending, merging, changing records), the question becomes governance. Who decided? Who reviewed? What can an agent never do? Most "AI adoption" stalls here, as a pile of prompts nobody can audit.

I wanted to know whether a multi-agent system could run real work under written authority boundaries, and whether a single human could stay the authority over every consequential action without becoming the bottleneck.

I built it the way I build everything: discover the real problem, capture how the work actually happens, then design backward from the outcome. The outcome I wanted was auditable: a record of every decision before code moved, and a human merge on every change.

Each agent got its own repository and a written contract: its lane, four autonomy tiers (automatic, confirm, approval item, mechanically blocked), and a list of things it may never do. Cross-lane work became a handoff through a ticket, never silent absorption. A shared knowledge base (orientation documents, a vault of skills, a registry of agents) became their common home, and every session starts by reading a fixed budget of it and writing an orientation receipt to its audit log.

Seat runtimes by role, not by vendor loyalty. An architect model owns contracts and boundary lines; an orchestrator model owns operations and merges; cheaper tiers do bulk classification; Codex and Gemini were evaluated head-to-head as builders and reviewers before being seated. Model assignment is a human decision, recorded.

And make review adversarial by construction: on the Agent Bridge, a GitHub label queue, one runtime builds, a reviewer from a different vendor must approve, the operator independently re-verifies, and only then does a human merge. Every turn leaves a PR comment with action, evidence, uncertainty, and next owner.

One orchestrator at the center owns execution, dispatch, and the operator seat on the build queue. Seven specialists sit beside it: contact truth and communication policy; document lifecycle; career artifacts; organization administration; memory stewardship (a daily drift sweep, propose-only); a planning peer for synthesis and prioritization; and a financial reconciliation specialist that runs read-only, single-user, and offline by contract.

The records lane is append-only (a backlog with progress records, a decision log, and a per-repo audit log), and bounded, time-boxed grants let the queue run overnight without widening anyone's authority. The human's surface is a local dashboard of intake cards, approvals, and settings for every model and schedule, mirrored to Slack for mobile: the orchestrator posts prepared drafts, the human replies in plain language, a classifier routes the reply, and every outbound send requires an explicit approval record.

Enforcement is mechanical, not aspirational: credential access blocked, permanent deletes blocked, outbound network deny-by-default with an allowlist, configuration changes provenance-tracked.

Eight active agents across three vendors, with 630 pull requests merged across nine repositories in a twelve-week window under review-then-human-merge discipline, on top of 710 in the window before it. Not one agent sends a message, spends money, or merges code on its own.

What it proves is the thing most AI programs can't: that governance and velocity are not a trade-off. The contracts are documents a reviewer can read. The decisions are written before the code moves. And the human is still the single authority over everything that matters, just no longer the bottleneck on everything else.