I build agents that work inside real operations and earn their autonomy one approved action at a time.
Three things I hold, each with a repo behind it:
- Policy belongs in the tool layer, not the prompt. A prompt rule is a suggestion the model weighs against whatever the user just said. A tool rule is arithmetic.
- Trust is a property of an action shape, not of an agent. It is earned on evidence, revoked on the first bad run, and never widened for convenience.
- An eval that cannot tell a fix from model variance is not an eval. So I take two baselines before I change anything, and I publish the negative result when that is what I found.
| If you want to see | Open | What it shows |
|---|---|---|
| An agent that argued itself into the wrong action, and code stopping it | carrier-desk | Freight carrier sales rep. Live FMCSA authority checks. The rate ceiling and caller identity are enforced in the tool layer; the model never sees the ceiling. 610 offline tests, six adversarial personas, and a before/after that admits what it cannot measure. |
| Autonomy earned per action shape, then revoked live | greenlight | Approval-gated IT agent: policy engine, approval queue, hash-chained audit log, trust ledger, counterfactual policy replay before any rule widens. Shipped July 2026. The AWS Architecture Blog described the same graduated-autonomy pattern that August. |
| A whole organization run under a human-written charter | meridian-os | Charter, World, Role, Gate, Ledger. Four agent seats, one deterministic gate unchanged since the first commit, 82 tests, six graded live scenarios including three red-team traps and a 26-order load run. |
| A product people paid for | capAI | Captain AI: an email and calendar chief of staff that drafts in your voice and never sends without approval. |
Each of those has a decision log or a design section that records why, including the calls that did not pan out.
- FieldMate (Toglo, 2026). Voice and camera coaching agent for HVAC technicians, in the field, hands busy. LiveKit and Python. Four layers: a deterministic state machine that owns every hard gate, a keyword fast path, a Haiku intent classifier that fails to none below threshold, and a Sonnet brain that can only advance a step on an explicit user request. A 45-case labelled intent benchmark climbed from 35 to 44 with the before and after committed. A 34-phrase bilingual adversarial corpus with monotonicity tests in CI guarantees a wrong judge can never open a denied gate. About 1,650 tests. Went from discovery to a live LTI 1.3 integration inside a multi-location HVAC company's training program in under 90 days.
- An FDE take-home for a voice-AI logistics company. Inbound carrier sales end to end, with a TCP-to-HTTPS adapter for a legacy TMS and server-side rate negotiation. 305 tests, eleven real voice calls, and a build document whose most-read section is the bug an adversarial review found.
- Twice a founder. I do discovery with the customer, then ship into the systems they already run, and I own the outcome when it breaks.
- I use AI coding agents heavily. The architecture, the boundaries, the test bar, the reviews, and the decision log are mine. Every repo above says so in its own words.
- Boring primitives where the stakes are: integer cents, identity from the session and never from the model, default-closed, first-match-wins, append-only.
parthahir.com · p.ahiir01@gmail.com · San Francisco