The Three-System Model
Most AI programs blur three different jobs: deciding what the organization wants, letting agents do the work, and governing the result. We separate them, connect them and make each one testable.
Human intent
What you want the agents to achieve, the limits they work within, and who has authority to decide.
Machine agency
How agents plan, delegate and act, through controlled delegation and structured hand-offs.
Defensible governance
- Prevent what you can
- Intervene when you must
- Substantiate what you did
What each system covers
- 1. Human intent
Objectives, constraints, authority, risk tolerance and trade-off rules, written so machines can be checked against them and versioned so changes can be traced.
An intent pre-mortem asks how the objective could be met in ways you would regret, before any agent starts work.
- 2. Machine agency
Controlled delegation through explicit delegation contracts, structured hand-offs between agents, autonomy matched to risk, and controls against manipulated content.
- 3. Defensible governance
Prevent with limits enforced outside the model. Intervene with Continuous Inquiry and the authority to pause. Substantiate with decision records built from actions.
What makes it different
Continuous Inquiry
Asks, on a schedule, whether the agents' instructions still serve their purpose. It uses four mechanisms: codified checks, independent reviewer models, behavioral baselines, and external signals with human review. The detection rate of each one is tested, not assumed.
Decision provenance
Records anchored to what agents did, not to what they say they did. When something goes wrong, the investigation rests on actions, and the evidence exists before anyone asks for it.
The problem it solves
We call it asymmetric illegibility: agents act faster and more widely than the organization can follow, while the duty to explain what they did stays with the organization.
- Operational
- You cannot reconstruct what the agents did.
- Causal
- You cannot say which decisions produced the outcome.
- Intentional
- You cannot tell whether the agents still serve the objective you set.
- Communicative
- You cannot follow what agents tell each other, even with every message logged.
- Governance
- You cannot show which controls applied, or whether anyone could have stepped in.
How our engagements map onto the model
| Engagement | What it is | Where it sits in the model | What you receive |
|---|---|---|---|
| Executive workshop | A half-day for the leadership team | All three systems, at decision level | Exposure map, tested decision rights, one-page design, 90-day plan |
| Agentic Safety Audit | Inventory and assessment of every agent and AI workflow | Exposure across all three systems, scored against eight executive questions | Agent inventory, exposure map, gap report by system |
| Trust Harness | Designing and testing the controls | System 1 (intent and authority) and System 3 (prevent, intervene) | Intent specifications, delegation model, pause rights, Continuous Inquiry with measured detection rates |
| Evidence Fabric | Making control provable | System 3 (substantiate) | Decision provenance design, record standards, examiner-ready reporting |
How it fits what you already use
The model complements the NIST AI Risk Management Framework, ISO/IEC 42001 and Singapore's governance framework for agentic AI rather than replacing them.
It draws on management cybernetics, in particular Stafford Beer's Viable System Model.