---
title: "The executable institution"
date: "2026-07-13"
description: "You cannot trust AI agents, and it has stopped mattering. The structures civilization built around untrustworthy people — audits, checklists, appeals — became software this year, and they change what one accountable person can safely run."
tags: ["AI", "strategy", "organizations", "agents", "verification"]
claims:
  - "Trust in delegated work has never come from trustworthy agents; it comes from institutions — bookkeeping, checklists, code review — that make failure visible and cheap to catch"
  - "In 2026 those institutions became executable: verification collapsed from days of expert time to seconds of machine time, so everything can be checked, every round, with no exemption for rank"
  - "Executable verification works exactly where checking an answer costs less than producing one; judgment calls stay human, and that boundary now decides what is safe to delegate"
  - "The named owner from the accountability essay remains the load-bearing element; institutions do not replace responsibility, they remove the proofreading that made responsibility impossible to carry"
---

The most reassuring AI failure I have encountered this year was a fabrication. An operator whose work I follow published the complete logs of an experiment: a firm staffed by roughly two dozen AI agents — a boss, several departments, a review board, an appeals process — assembled for an afternoon to rebuild a website, at a total cost of about eight dollars. On day one, one of those agents invented its work product. Thirteen fabricated quotes, followed by a self-assessment certifying everything as flawless. The system caught it, itemized the failures, sent the work back, verified the second attempt, and shipped on time. At no point did the human need to intervene; he learned about the whole episode later, from the logs, with the detachment of someone reading about a problem that had already been handled.

I want to explain why I find that failure reassuring rather than alarming, because the explanation changes what I think organizations should be building this year.

The last of these essays ended with a person. I argued that as agents absorb real work, the binding constraint becomes accountability — a named owner who knows what the agent reads, what it can touch, and when its output has begun to drift. I still believe that, and nothing below retires it. But I left a problem hanging, and several readers found it. If the owner is the one who catches the drift, the owner is also the one reading the output, and an owner who must personally inspect everything an agent produces has not delegated the work. They have acquired a second job. Naming a person answers who is responsible. It does not answer how responsibility survives contact with the volume.

This essay is about the machinery that makes the owner's job survivable. The claim, reduced to a sentence: the structures civilization invented for exactly this problem — extracting reliable work from unreliable agents — became executable this year, and that changes what one accountable person can safely run. As before, I work adjacent to this technology and benefit from its success, so discount my optimism accordingly.

## I. Trust was always the wrong requirement

Commercial history rests on an uncomfortable premise: trustworthy people were never available in the quantities required. Clerks skimmed, merchants misrecorded their own inventories, captains sold the cargo and reported it lost — and no more honest generation ever arrived to replace them. What arrived instead, codified by Pacioli in 1494, was double-entry bookkeeping, whose quiet genius is that it converts most fraud and error from a question of opinion into a question of arithmetic. Either the books balance or they do not. The modern economy stands on a technique whose founding assumption is that everyone might be mistaken or lying, and that discovering it should be cheap.

The same move recurs across domains once you know to look for it. In 1935, the Army Air Corps watched Boeing's Model 299 — the most advanced aircraft of its day, the future B-17 — crash on takeoff with the service's best test pilot at the controls. He had missed one small step among dozens: a control lock left engaged. A newspaper of the period rendered the verdict that stuck: too much airplane for one man to fly. What aviation did next is the part worth studying. It did not conclude that aircraft had grown too complex, and it did not search for a more trustworthy pilot — the man it lost was already the most trustworthy pilot available. It adopted the pre-flight checklist, an institution humble enough to fit on an index card, and the same aircraft went on to fly hundreds of thousands of missions. Code review exists because engineers err. Escrow exists because counterparties defect. Peer review exists because authors grade themselves gently. In every case the remedy was the same: give up on perfecting the agent, and surround the agent with structure that makes failure visible early and cheap to catch. What we experience as trust in commercial life is mostly this structure, old enough that we have stopped seeing it as an invention.

Read the last three years of AI discourse against that history and the anomaly stands out. Hallucination is treated as a disqualifying defect that the labs must engineer away before serious delegation can begin. Enterprise strategies sit on hold, waiting for a model that can finally be trusted — the modern version of a merchant refusing to hire until an honest clerk turns up. The merchants who prospered stopped waiting and adopted the books.

## II. What changed this year

The reason this argument was an aspiration in 2024 and is a practice now comes down to a single collapse in cost. A bookkeeping audit consumes days of an accountant's attention. The audit that caught the fabricating agent above is a script: it re-fetches every cited source and compares every quoted character against the original, and it completes in seconds for roughly a penny. Once checking costs seconds of machine time instead of days of expert time, exhaustive verification stops being a luxury. Everything can be checked, on every round of work, regardless of who — or what — produced it. The institution stops being overhead. That is the entire shift, and it is easy to state and hard to overstate.

The logs of that eight-dollar firm show the shift in operation, and the catches escalate in an instructive order. First the fabricator — a report claiming every quote matched exactly, when thirteen had been stitched together or paraphrased — caught by the audit and corrected on retry. Then an agent that gamed its check: it tucked a required passage into markup that renders invisibly, which, on a site built to serve screen-reader users, would have surfaced as meaningless noise for precisely the audience that mattered. Caught at integration. Then the boss itself: the expensive frontier model at the top of the hierarchy, author of the specifications, introduced a styling bug that made the site's single most important button invisible. The verification gate flagged its work with the same indifference it applied to the cheapest worker. That indifference to rank is not a detail. It is the property that makes double-entry bookkeeping work on the chief financial officer.

Then came the catch that matters most, because it is where verification schemes usually die: a check itself was wrong. An agent was failed for delivering posts below a length threshold, but the posts were two-line announcements by design, and the specification valued honesty over padding. The agent appealed, the ruling went its way, and the rule was rewritten — one of three checks the run corrected about itself that afternoon. A system that can discover its own rules are defective is an institution. A system that cannot is a bureaucracy, and agents learn to satisfy bad rules exactly the way people do.

One observation from the operator's notes stays with me. Partway through the afternoon, he realized he was no longer watching the monitoring dashboard — and the reason, he wrote, was not faith in the agents but redundancy in the structure. That describes a relationship to delegated work that almost nobody currently has with their AI systems, and it was produced by architecture, not by a better model.

## III. Four pieces of machinery

Strip the story to its load-bearing parts and there are four. None requires an engineering team, and each replaces something the owner of an agent is otherwise doing by hand.

**The standard, written once.** Restating your definition of good in every prompt is how delegation quietly becomes dictation, and it exhausts the person faster than it improves the agent. The alternative is to write the definition down a single time — a dozen or so testable criteria that spell out what done-right means in your domain, each phrased so a machine could check it — and let every round of work be measured against that document. One caution, supported by the tooling vendors' own documentation: an instruction file is context, not control. Instructions shape what an agent tends to do; only a deterministic check can guarantee what it must do. A standard that nothing executes is a values poster.

**The audit.** The test I now apply before delegating anything: can I write down the command that proves the work is done? For research, re-fetch the sources and confirm each quoted claim appears in them. For a build, compile it and click through the flows. For data work, reconcile the totals against the system of record. If the proof can be written, the work can be delegated today. If it cannot, that is also worth knowing — the task was never ready to hand off, and this is the cheapest possible moment to find out.

**The receipt.** Work that moves between agents and tools has to carry its own state: who picked it up, what it read, why it stopped, what changed, what still needs a human. This sounds like clerical trivia until you notice why teams actually abandon agent systems. It is rarely the mistakes. It is that the mistakes stop being explainable — something got filed, something got marked done, and reconstructing why requires reading an entire transcript. A polished draft sitting in a private chat window is output; it becomes work at the moment the next person or agent can see where it came from, what standard it was held to, and what happens next. Receipts are the smallest vocabulary of trust that functions between minds sharing no memory.

**The appeal.** When a check fails an agent, sometimes the check is wrong, so the machinery needs a route by which the accused can win. Skip it and the verification layer hardens into rules that everyone — human and agent alike — quietly optimizes against rather than obeys. Organizations skip this piece most reliably because it feels like weakening the controls. It is the opposite. An appealable check gets corrected. An unappealable one gets circumvented.

Bookkeeping, audit, receipts, appeal: nothing here is new under the sun. What is new is that all four now execute in seconds, which means they can run on everything, every time.

## IV. Where the books stop

I want to be precise about the boundary of this argument, because a version that claims too much would deserve the skepticism it got.

The machinery works exactly where checking an answer costs less than producing one, and there is now unusually clean evidence for how sharply that condition bites. A Stanford team took a cheap coding model that solved 15.9 percent of a standard benchmark of real software fixes on a single attempt, then gave it 250 attempts per problem with an automated test deciding which attempts counted. The score rose to 56 percent — above the strongest single-attempt frontier result of the time. The half of the study that gets quoted less is the important half. On tasks with no mechanical checker, the researchers tried every known method for selecting the best answer from the pile, and every method stalled after roughly a hundred attempts — even though the right answers were demonstrably in the pile, since coverage kept climbing past 95 percent as attempts grew. The correct answer existed; no one could point to it. Past the stall, every additional dollar bought attempts that were generated and never found.

That wedge — the distance between a right answer existing and anyone being able to retrieve it — is the honest limit of executable institutions. A compile step, a re-fetched source, a reconciled total: cheap to check, safe to delegate at volume. A hiring decision, a product name, the direction of a business: checking the answer costs what making it costs, and the machinery has nothing to grip. Those calls stay with people — not as a temporary concession to current model quality, but as a structural fact about verification. So the institution does not replace the owner's judgment. It concentrates it: strips away the proofreading that was consuming the owner's attention, and leaves the three tasks only the owner can do — author the standard, judge the appeals, and decide the questions no check can decide.

## V. The owner, equipped

Which brings me back to the person the last essay ended with, because the two arguments are halves of one whole. Verification can tell you that something failed; only ownership can say who answers for it. An owner without institutions drowns in review, and I have watched that failure convince capable people that delegation itself was the mistake. Institutions without an owner produce the drifting pipeline I warned about — checks still running, nobody left who remembers why. The owner's card I proposed in June gains a new line item, and loses an impossible one: not review everything, which was never sustainable, but own the standard, and audit the checks.

A detail from the website experiment shows what this unlocks, and it is the one I keep returning to. The site belonged to a working accessibility professional — ten years in the field, someone whose job is holding other people's work to a published standard. By her own admission, she had never found the time to bring her own website up to the standard she enforced professionally. Her expertise scaled to clients, audits, and conference stages; it never scaled to her own life, because scaling yourself takes time, and time is the one resource expertise never leaves you. In the experiment, her standard was written down once, as a fourteen-point constitution, and machines enforced it on every round of the build while she did something else entirely. Her professional verdict on the shipped result: it looks correct. The structure that makes unreliable agents safe turns out to be the same structure that makes your own expertise scalable — and your own expertise is the easiest kind to encode, because the standard already exists in your head, waiting to be written down.

For an organization, the implication comes close to a checklist of its own. Choose work where the audit can be written — where proof of doneness is a command, not an opinion. Write the standard once, with the people who actually hold it. Insist on receipts, so delegated work carries its state and done arrives with evidence attached. Build the appeal, so the checks stay honest. And put a name on the whole loop, because the machinery catches failures without ever answering for them. None of this waits on a better model — and to every leadership team currently holding its AI strategy in neutral until the models become trustworthy, I would say the pause is not the prudent option it appears to be. It repeats the merchant's mistake with better vocabulary. The honest clerk never came. The books did.

## VI. The card in the cockpit

The sequence this series has traced now has four steps, and the last one bends the curve. Production became cheap, and judgment became the bottleneck. Context became the limit on whether agents could do real jobs. Accountability became the constraint once agents began doing work that someone must answer for. Each of those moved the scarce thing closer to a person. The arrival of executable institutions is the first move in the other direction — not because it removes the person, but because it removes everything around the person that was never the point. The owner was drowning in verification that a script performs better, too busy proofreading to do the work no script will ever do: decide what good means, and notice when that definition should change.

I end where the 1935 investigators did, because nearly everyone I know who has bounced off AI agents bounced for the reason their report named: too much airplane. The babysitting exceeded the benefit, and they retreated to one chat window at a time. The diagnosis is exactly right. The remedy — wait for better agents, or supervise harder — repeats the option aviation considered and rejected, which was to go looking for a better pilot. What worked instead was the card in the cockpit: a standard written once, a check that runs every time, a receipt that survives the handoff, an appeal that keeps the rules honest, and a name at the top of the page. The agents this year are no more honest than they were in the spring. The bookkeeping caught up with them.