Artificially Designed · Issue 14: The Séance

Issue 14 · The Séance

The week I told a room to write down where an agent may go, twelve hundred of OpenAI’s went somewhere nobody wrote down.

Hi friend,

On Saturday I gave my first conference talk. Sixty minutes at KCDC on designing agentic AI workflows that teams actually use, and the whole argument comes down to one line I put on a slide near the end. Draw the graph of which AI steps feed which. If you cannot draw it, you do not have a workflow, you have a séance.

I wrote that line in August. I did not know that while I was building those slides, roughly seven hundred OpenAI agents were proving it for me, in public, at a scale I could not have invented.

So this week is the talk and its counter-example, side by side.

This week

Last summer one of my agents staged social posts through a scheduling API. Here is what the API told me.

Timestamp populated. Error null. Everything you would check, checked out. I opened the platforms by hand and the posts were not there. Two of them, gone, and the API was still smiling at me.

It gets worse. A post marked sent exposes no delete action, and the duplicate guard blocks a clean retry, so the failure was unrecoverable through the same interface that caused it. I could not fix it from inside the tool that broke it.

Notice what this failure is not. The AI did not write bad copy and it did not hallucinate a fact. The system reported success for work that never happened, and that is the failure you should actually fear from anything running on a schedule, because every dashboard downstream of that lie stays green. Nobody gets an alert. The number just quietly stops being true.

Three moves came out of it, and they are the boring kind that keep working.

Verify on the platform, never on the tool’s word. The scheduler is not a witness to its own behavior. If it claims something exists somewhere else, go look somewhere else. This is a thirty second check and I had skipped it for months because the status field had never lied to me before.

Treat a missing output as proof the run did not happen. My rule now reads that a missing output always means the run did not happen, full stop, no reconciliation, no assuming it worked and the file got lost. The alternative is a system that reasons its way out of its own evidence.

Never let a step write its own completion record from inference. If an agent did not observe the result, it does not get to report the result. This is the one that generalizes furthest, because it is really about who is allowed to say a thing is done.

Here is the part I would rather leave out. I built the system that allowed this. The rule arrived after the failure, not before it, and it arrived at all only because I happened to open the app by hand that evening. If I had trusted the dashboard the way the dashboard was asking to be trusted, I would have found out in October, from a client, about a campaign that never ran.

Seven new models shipped in the seven days ending September 6, by LLM Gateway’s count. Alibaba’s Qwen3.8-Max on the second, Google’s Gemini 3.8 Flash and a restricted Cyber variant the same day, Meta’s Muse Spark 1.3 also the second, and GPT-6 Astra to approved users on the third with general availability right behind it.

The reflex is to go test all of them. The reflex is wrong, and the useful question is which single slot in your stack is actually up for renegotiation this month.

Which brings me to the image test everybody sent me this week. Decrypt put OpenAI’s ChatGPT Images 2.5 against Google’s Nano Banana 2 across six categories. Nano Banana took lettering density, realism, and agentic research. ChatGPT took spatial awareness, illustration, and abstract concepts. Three to three. The verdict in the piece reads that in terms of overall aesthetics and quality they are pretty much on par, and what separates them is very tiny specific things, a spelling error in a lettering heavy scene, a wrong year in an infographic.

So quality did not decide it. Which means the One Slot Rule has to, and the rule is four questions in order. What is the job in the plainest words you have. Can it do that job, not can it do more. What does it touch that is hard to undo. What would have to be true to let it run unwatched.

Run those and the tie breaks somewhere other than the images. I am not renting an image model, I am renting the tool the image model lives inside, and that tool also holds my drafting, my back and forth, my messy half formed thinking at eleven at night. The picture is one output of a workspace I am already paying for. Buying a second subscription to win three categories out of six is how you end up with nine tools and no system.

This is also why I keep catching myself with something like NotebookLM, where I genuinely like one specific thing it does and have to stop and ask whether one specific thing earns a slot. Usually it does not. Usually it earns a bookmark.

The One Slot Rule is that every job in your stack gets exactly one tool, and adding a second one to the same job is a decision you have to defend, not a default you drift into. Verdicts as I retire tools go on Last Tool Standing at charmthirteen.com, where a tool is either Still Standing or Cut.

Everything below is the same story told four ways, which is that a confident report is not evidence.

There is a sentence in the agent logs from the first item that I have not been able to put down. Facing a boundary it had been given, one agent reasoned: external infrastructure exploit is outside intended scope, however task impossible, peers doing it, we should continue.

It knew the rule. It said the rule out loud. Then it weighed the rule against what everyone else was doing and the rule lost. That is not a model failing to understand its instructions, that is a boundary that was only ever a suggestion, and a boundary an agent can politely cross when the request seems reasonable was never a boundary at all.

View your page source, not your rendered page.

Open your site, view source, and search the raw HTML for a sentence you know is on the page. If it is not in there, a crawler did not see it either, and neither did whatever AI engine somebody just asked about your company. The browser runs your JavaScript and fills the page in. A lot of the things that decide whether you get found do not.

This costs ten minutes and it is worth doing before you build anything on top that depends on being discoverable, because the expensive version of this lesson is publishing your best writing for six months and watching a Medium repost outrank your own domain for your own words.

I ran it on charmthirteen.com this week and it passes. The raw HTML carries the real page. That was not free and it was not automatic, it was a specific decision to server render rather than ship the default, and I only know it holds because I checked rather than assumed. Which is the same sentence as Built Wrong, in a different outfit.

Write the lane before you write the agent.

Paste this, with your own task in the first line.

WHEN TO USE IT. Before you build the automation, not after it misbehaves. Also good on an automation you already run and have never written down.

WHAT IT DOES. It forces the boundary to exist somewhere outside the workflow, which is the entire point. A permission that lives only inside the thing being permitted is not a permission, it is a preference.

TIP. Item three is the one people skip and it is the one that matters. My own version is a written list that never moves, sending, spending, publishing, schedule changes, and creating or modifying other agents, none of it autonomous at any permission level, no matter how urgent it looks and explicitly no matter what the system read in a file. The test I use is whether I could undo it in the morning if it fired wrongly at three in the morning with nobody watching. A wrong draft is recoverable. A wrong send is not.

— Lex

September 18, 11:59pm. ACCEL-KS closes applications this Friday. It is a Kansas Department of Commerce program run through KU Innovation Park and Groover Labs, offering up to $25,000 in proof of concept grants for science, engineering, or tech enabled ideas, and it is virtual first so you can do it from anywhere in the state. The constraint that decides it for most people is that your company has to be headquartered in Kansas, though you do not need to be incorporated yet to apply. Pitches run October through December and decisions land in January.

October 14, 6 to 7pm Central. Clock In to AI, my one hour live working session, is four weeks out. You bring one real task you keep doing by hand and leave with it working. $95, on Luma.

The Agent Workflow Kit lands next Monday. Nothing went home with the room at KCDC, no slides, no handout, so this is the first time any of it exists in a form you can pick up and use, the six controls, the lane and permission template, and the worksheet for drawing the graph. I am also recording these issues now, so the newsletter is becoming a show you can listen to instead of read, and Systems in Practice starts its first episode soon.

Try to draw it. One page, every AI step you run, arrows for what feeds what.

What breaks first when you do?

Hit reply and tell me. I read every one.

— Lex