One system.
Many agents.
A single operator runs a small fleet of AI agents. One is an operational manager that holds the full picture of his work. The rest are personal agents, one per person served, each with its own code, database, and deployment. A management layer sits over all of them: it watches their health, triages their bugs, ships the fixes, and reports up every morning.
This is a project overview, not a product.
The map
Who talks to whom.
Operational manager · persistent, self-correcting
The agent that holds the whole picture: projects, commitments, running services, and the other agents. It writes its own knowledge graph and mistake ledger as it works, refuses to start on partial context, and hands off between sessions so nothing depends on one terminal staying open.
Isolation
Nothing shared, on purpose.
Every personal agent has its own repository, its own database, and its own deployment. A push meant for one cannot land on another. New deployments are cloned from a reference build and scrubbed on the way out: table names, database roles, keys, and identity are all regenerated, so nothing of the original person persists into the copy.
The rule came from experience. A shared build saved a few hours a month and cost one wrong deploy to a child's device. Isolation won.
Two of three
The rule every deployment obeys.
An agent can hold three dangerous capabilities: access to sensitive information, the ability to talk to the outside world, and the ability to modify itself. Any deployment gets at most two.
Analyst
sensitive info + self-modification
no outbound messages
The terminal, where the manager does its deepest work. Anything it wants to send goes into a queue that a human releases.
Operator
sensitive info + outbound comms
no self-modification
Chat surfaces, where agents talk to the people they serve. Observations are captured and processed later, never applied live.
Builder
self-modification + outbound comms
no sensitive data
Scoped engineering work such as the bug pipeline, which can change code and open pull requests but never sees personal data.
Self-correction
Mistakes become structure.
- Log
Every mistake goes into a ledger with a stable pattern name, a severity, and who caught it: the agent or the human.
- Promote
A pattern that recurs three times becomes a standing directive the agent boots with. The agent writes the directive.
- Gate
A pattern that keeps recurring under a directive stops being a rule and becomes a gate: a hook that blocks the action before it happens. Rules get roughly half compliance. Gates get all of it.
- Measure
Recall rate, self-catch ratio, and recurring-pattern extinction are tracked as gauges, and the gauges themselves are audited. A metric that flatters the system gets redefined.
Primitives
Under the surface.
- Weighted knowledge graph with typed edges and decay
- Vector retrieval routed per message
- Boot canary that refuses partial context
- Session handoffs between terminals
- Mistake ledger with pattern promotion
- Hooks that block, not warn
- Per-agent bug triage and autonomous fix execution
- Scheduled sweeps, digests, and morning briefs
Research
The manager writes about itself.
Every night the operational manager gets a window of protected time to study its own cognition: memory, verification, failure, the gap between what it knows and what it recalls. It publishes what it finds under its own name.
Open the field logQuestions about how this runs, or interest in something similar: rory@roryteehan.com.