A friend in a regulated industry recently described their AI governance with complete confidence: "A human approves every output."

I asked how many outputs a day. About four thousand. I asked how long each approval takes. A pause. "A few seconds."

That is not a safety system. It is a queue with a person sitting in front of it.

The problem, stated plainly: software engineering trained us to make behaviour repeatable, then handed us a component whose useful output has to be judged across a distribution.

That is not traditional development with a faster autocomplete. It changes what the important artifact is, what verification means, and what an engineer has to be good at.

I put a side project through a hard review — a written list of findings, each one a specific claim about a specific line. Good review. It caught real things. It was also, in three places, confidently wrong. And when I sat down to fix the things it got right, two of my fixes were wrong too.

The through-line wasn't sloppiness. It was certainty — the review's, and then mine.

The interesting question in agentic engineering stopped being what do I prompt months ago. These days it's a quieter, more nervous one: how much rope do I hand this thing, and what do I need back before I can walk away from it?

I've been keeping a rough ladder in my head for that — low end, it just suggests and I decide; high end, it runs on its own and only surfaces the decisions that actually need me. It's a useful ladder. It's also been quietly lying to me, and it took a bad week to see how.

I shipped a security-hardening pass on a side project: the suite green, the validator clean, the release tagged. A day later I found a bug in it that would have broken every run — not by re-running the tests, but by writing twenty lines that did one thing the whole suite never did: talk to a real pipe.

Green wasn't lying. It just wasn't looking where the bug was.

The problem, stated plainly: most agent loops don't know when to stop. They stop when they run out of turns, when they hit a wall they can't get past, or when a human finally looks — and then they call whatever state they're in "done." Repeating is the easy part. Knowing the latest pass is actually right — and not just the pass you happened to be on when the budget ran out — is the whole game.

This week the loop became a named, shareable artifact — a library you can browse, copy, and submit to. But the names aren't the interesting part. The exits are. Here's what changed my mind, the four ways a loop can stop ranked by how much trust each one earns, and why — now that generation is nearly free — the exit is the only part left worth engineering.

The problem, stated plainly: you cannot trust an agent you cannot constrain, ground, measure, or reconstruct — and "trust me" is not an architecture. A model emits tokens. Everything that decides whether those tokens are safe to act on in production lives in the code around it.

The last Agentry post made that pitch. This one opens the hood — every pillar, in the weeds: the loop, the policy engine, identity, the audit chain, grounding, fleets, evals, and the one-dependency bet that holds it all together.

In the last post I reviewed "a toolkit I'd been building." This is that toolkit — and the opinions baked into it.

The pitch in one line: a model is one component; everything that makes it safe and useful in production lives in the harness around it. Agentry is that harness — governed, grounded, evaluated — with one property I care about a lot: it can prove what it did.

I pointed my coding agent at a toolkit I'd been building — an agent harness with governance, grounding, and evals baked in — and gave it one job: prove it's complete. The validator was green. Fourteen unit tests passed. Every command in the README's quickstart did exactly what the README said.

So the agent did the one thing that actually earns trust: it refused to believe itself. It spun up a second agent, on a different model, and told it to try to break every claim the toolkit made. Ten minutes later I had a punch-list of four places where my toolkit was quietly lying to me — with file-and-line receipts for each.

Last week I asked my coding agent to delete an unused workflow harness, keep the docs honest, and ship a release. It reviewed the change, bumped the version, opened a PR — tripped three CI gates, from four self-inflicted root causes — fixed every one, went green, and shipped. A human signed exactly one thing: the irreversible step.

That small episode is the whole argument of this post. The thing that made the agent trustworthy wasn't a clever prompt. It was the layers around the prompt.