The safest-looking agent architecture is a large set of gates. Define every permitted action, every required review, every valid state transition, and every condition under which work may continue. The model remains creative inside a cage whose bars are deterministic.
This works for genuine invariants. A system should not let a model approve its own authority expansion, exceed a hard budget, rewrite an external receipt, or delete an unresolved broad target. The difficulty begins when we promote every good practice into the same kind of law.
Open-ended work contains too many context-dependent choices to enumerate. The attempt to govern all of them prospectively makes the system rigid, stale, and paradoxically less safe: workers route around the machinery, owners approve meaningless exceptions, and internal state acquires an authority it cannot keep current. Restless uses hard enforcement at true authority boundaries and relies elsewhere on evidence, conventions, review, recovery, and receipts.
An invariant is a very expensive claim
Calling something an invariant says the system may block useful work rather than permit its violation. That is appropriate when failure creates unacceptable irreversible harm and the condition can be checked reliably. It is not appropriate merely because a behaviour is desirable.
“Never spend beyond the granted amount” can be evaluated against authoritative budget state. “Always perform enough research” cannot. “Do not send the same payment twice” can be implemented with idempotency and provider reconciliation. “Always choose the right specialist” depends on the task, available workers, and evidence that may not exist yet.
When an open-ended judgement is disguised as a deterministic rule, complexity moves into proxies. Count sources. Require two reviewers. Demand a particular team shape. Enforce a workflow stage. The proxy becomes the target and the original quality disappears behind compliance.
Hard gates belong at authority boundaries
Restless reserves deterministic control for the substrate of identity and consequence. Authentication, capability checks, budget enforcement, approval state, effect execution, and authoritative receipts do not depend on a model deciding whether its own request is reasonable.
The distinction is consequence, not network access. Public research can happen directly from the company runtime because reading a page does not usually commit the company. Sending an email, charging a card, publishing a deployment, or registering a domain changes the external world and requires an effect intent and receipt.
This keeps the hard layer small enough to remain trustworthy. Unsupported high-impact actions can simply have no adapter yet. The system does not need a universal policy language for every tool. It needs exact enforcement where authority moves and a durable account of what happened.
A receipt is not a log line
Logs describe activity from the perspective of a process. A receipt answers an accountability question. What consequential action was intended? Who or what authorised it? Which tool or provider executed it? What exact target and idempotency key were used? What outcome did the authoritative source confirm?
The distinction becomes critical when the local process is uncertain. A network timeout after sending a request does not prove failure. Marking it failed and retrying can duplicate the effect. Marking it successful invents external truth. The receipt enters an unknown state until reconciliation asks the provider what actually happened.
A receipt also survives runtime restoration. The company computer can return to an earlier snapshot, but external history cannot. Keeping receipts outside the mutable runtime prevents a recovered agent from reenacting consequences that already occurred.
Most internal work should remain flexible
Inside the authority boundary, a worker may need to inspect an unfamiliar repository, change tools, reorder steps, branch an approach, discard a draft, or repair an unexpected environment problem. Encoding the permitted sequence in advance would require the designer to know the work better than the worker performing it.
Restless records responsibility, exact attempts, artifacts, evidence, and material decisions without converting every file edit or model judgement into governed history. OrgIntel's operational stream can be compacted and repaired. Git records meaningful checkpoints rather than every keystroke. Messages remain useful context rather than immutable constitutional events.
This is a deliberate rejection of append-everything governance. A permanent ledger of every internal action increases storage and review surface while making important consequences harder to see. Accountability needs selective durability.
Receipts allow retrospective intelligence
Rules act before work and must be written from anticipated situations. Receipts act after a consequential crossing and preserve what actually occurred. That record can support audit, reconciliation, owner review, and organisational learning without requiring every future case to resemble the past.
Suppose a company repeatedly uses an external service in a way that produces expensive corrections. The receipts can reveal the pattern: target, purpose, cost, outcome, and the Work that requested it. The organisation may respond by changing context, adding a review convention, narrowing authority, or introducing a hard limit if the failure is enumerable and unacceptable.
The receipt does not decide which response is correct. It makes the decision evidence-bearing. This is important because a single failure should not automatically become permanent policy. Repeated evidence may justify a constraint; local judgement should remain local until then.
- Record consequential intent before execution.
- Bind authority, target, purpose, and idempotency to the intent.
- Preserve provider-confirmed, self-attested, failed, and unknown outcomes distinctly.
- Use patterns in receipts to inform policy; do not turn every incident into a new invariant.
Rules become dangerous when their state is stale
A deterministic gate feels safer than model judgement because it is predictable. Predictable use of wrong state is still wrong. An internal policy can lag the owner's current intent. A dependency graph can claim work is blocked after the real constraint disappeared. A required workflow stage can force an unnecessary handoff because the task no longer fits the process that created it.
Before enforcing an internal invariant, Restless asks whether stale state would block useful work and whether the failure is genuinely unacceptable. If the answer is uncertain, evidence and recovery may be the safer design. A model can notice context the rule did not encode; the record can make its choice reviewable.
This is not permission for agents to ignore policy. It is a demand that policy state its jurisdiction. Hard rules own identity, authority, budgets, and irreversible effects. Operational conventions guide work and can be challenged through accountable judgement.
Accountability needs discretion
There is a common fear that flexibility weakens accountability because the worker can choose a path nobody approved. Human organisations demonstrate the opposite every day. A good employee is accountable for an outcome partly because they can adapt when instructions stop matching reality. Following a broken process exactly is not responsible behaviour.
Discretion becomes accountable when the outcome, responsible actor, evidence, authority, and consequence remain visible. A worker can choose a different implementation while still returning the exact artifact and checks. A lead can replace a failed producer while preserving the Work. An agent can use a browser instead of an API while the resulting external effect carries the same receipt.
The system governs what must not drift and records enough of the rest to support judgement. This is a more demanding architecture than either total freedom or total workflow control because it requires clear ownership of every kind of truth.
Receipts have limits
A record after the fact cannot undo harm. High-consequence actions still need preventative authority checks, bounded capabilities, and sometimes explicit owner approval. Receipts complement gates; they do not replace them.
Receipts can also become bureaucracy. Recording unnecessary payloads creates privacy risk. Treating every internal review acknowledgement as a consequential receipt floods the record. A receipt generated by the acting company is weaker than confirmation from the external provider and should be labelled accordingly.
The design standard is proportionality. Preserve enough to answer who intended what, under which authority, against which target, and with what authoritative outcome. Do not copy secrets or entire provider payloads merely because storage is cheap.
Complexity should move toward evidence, not law
As an agent company performs more varied work, the number of sensible behaviours explodes. Trying to encode them all produces a policy system as complex as the world it governs. The policy becomes another fallible organisation—except its errors are harder to override.
Restless chooses a smaller constitutional layer. Keep identity and authority firm. Let reversible work remain open-ended. Bind claims to evidence. Record consequential crossings. Preserve unknown outcomes honestly. Review patterns and adapt the organisation when real results justify it.
This is why receipts scale where rules cannot. A rule must correctly anticipate the situation before work begins. A receipt can faithfully describe what happened in a situation nobody predicted. In a world of flexible machine labour, that difference preserves both productivity and the possibility of responsibility.