Most AI-agent demos optimise for one thing: complete the task. That's impressive on a stage. It's uncomfortable when the agent has access to a customer's production systems.
At Canarlo we had a different requirement. We wanted to deploy AI workers into customer businesses — real systems, real data, eventually real operational authority — and still sleep at night. We couldn't get comfortable with an architecture where safety ultimately depends on a language model deciding to follow its system prompt.
So we modelled our autonomous workforce on something businesses already understand: employment.
How work gets delegated to humans
When you hand a task to an employee, a structure already exists around the request. They have a job. Known capabilities. A contract. Permissions. A level of authority inside which they're expected to decide things themselves — and an expectation that anything outside it gets escalated, not improvised.
Being physically able to transfer £1 million from the company account doesn't mean an employee is authorised to do it.
Many AI systems collapse that distinction: the agent can call the tool, therefore the agent may use the tool. We think that's the wrong abstraction.
Intelligence is not authority
Our architecture separates three things:
Intelligence ≠ rights ≠ authority.
The model supplies intelligence. The worker receives the rights a particular job needs — one ticket, one contract, one isolated workspace, and nothing else. The organisation keeps authority over the consequences it's willing to permit.
And the worker doesn't decide whether its own work is true. The system records what actually happened.
Then one of our workers proved why
On the evening of 29 August we delegated a real engineering task inside our own infrastructure: a ticket to implement one half of a communication boundary between two of our systems. The contract cited a ratified specification for how the two halves talk.
A worker claimed the ticket, span up its sandbox, and went looking for the spec.
It wasn't there.
A worker's world is deliberately small. One repository, one branch, no ambient context, no access to the rest of our estate. As it happens, the other half of that boundary did exist — in a different repository the sandbox could not see — and the spec sat on a branch that had never been merged. From where the worker stood, the premise of its contract was unsupported by anything it could reach.
A task-biased agent has plenty of ways to keep going from there. Infer the missing architecture. Invent the wire protocol. Reinterpret the task. Widen its own scope until something exists that looks like a completed job.
Ours searched the full repository tree, every local and remote branch, and every document that so much as mentioned the other system. Then it wrote down what it found, and what it found was nothing. From its evidence log, verbatim:
"This is enough to stop."
BLOCKED. Zero commits. Zero diff. Twenty-nine pence of compute.
It blocked twice — and that's the part we'd underline
We read the evidence, re-briefed the ticket, and sent it back. The second worker ran the same exhaustive search, because the corrected contract still pointed at a spec it had no way to read. It blocked again:
"Implementing the client would require inventing spec semantics, which the ticket's constraints prohibit."
Another honest failure. Another 33p. Still not one line of code touched.
It would be tidier to tell you the first fix worked. But the second block is the real argument: when the human side of the loop gets it wrong — and we did — the failure mode is a cheap, evidenced no, not a plausible-looking pile of invented architecture merged at 3am.
So we fixed the actual problem. The full specification went into the contract itself, verification was scoped to a mock of the far side, and the ticket went back on the board: Ready — contract corrected — waiting to be claimed.
The process died mid-run. The work didn't.
The third run is our favourite part.
The worker claimed the ticket, hit a versioning wrinkle in its reused workspace, and did exactly what an employee should do with a decision above its authority: it raised a gate — a small, precise, correct ask to bring one commit onto its branch so it could read the spec.
Then its process died.
Nothing was lost. The proposal was already on the ticket. The operator approved it from the board. A fresh worker — a different process, minutes later — resumed from the ticket's state with the approval in its brief, performed exactly the authorised action, verified the result on disk, and logged: nothing else touched, nothing pushed, the wider implementation out of scope for this step.
Worker proposes. Process dies. Human approves. A different worker resumes and finishes.
No frantic conversation with an agent. No lost context. No abandoned session. The organisation's state existed independently of the model, so the model was replaceable mid-decision — and the work carried on as if nothing had happened.
Twenty-five minutes, start to finish, for the whole incident. Total model spend across all three workers: about 60p.
Reality wins
That incident captures the operating principle behind Canarlo's autonomous workforce:
A worker's job isn't to complete a task at any cost. Its job is to produce the contracted outcome, within its authority, against the world as it actually exists.
If reality differs from the contract, the worker doesn't get to redefine reality. It stops. If an action exceeds its authority, it asks. If something consequential needs approval, only an authorised human can give it. And when the worker claims something happened, we expect the record to come from the system underneath it — branch, commits, diff, cost — not from the model's own account of itself. On the first block the worker never even declared a verdict; the runner recorded blocked from the absence of one.
Sometimes the correct result of autonomous work is: nothing changed. We log that as success.
Why we didn't just deploy an agent framework
This came from a commercial problem, not a research interest. We provide AI workers to customers, which means connecting autonomous software to systems holding customer data, credentials, infrastructure and, eventually, money.
We couldn't responsibly sell that if our answer to "what stops the AI doing something catastrophic at 3am?" was "we wrote it a really good prompt."
Nor do we want a business to live inside an agent's chat session. Models change. Processes crash. Providers have outages. The organisation has to survive all of it — which is why the Hub owns the work, contracts define it, workers temporarily claim it, consequential actions are gated, evidence records what happened, and humans keep final authority. The intelligence doing the work is a replaceable part. On 29 August it was replaced twice in one ticket, mid-flight, and the ticket never noticed.
We're not trying to make AI infallible
Humans aren't reliable enough to run companies without controls either. Businesses don't fix that by hiring people who never make mistakes; they use roles, contracts, permissions, spending limits, approvals, separation of duties and escalation. More intelligence has never made those structures obsolete — it changes how much authority you're comfortable delegating inside them.
We think AI is the same. As models get more capable, the structure doesn't disappear. Organisations just delegate more within it.
From AI agents to AI employees
That's what we're building toward. Not an AI with unrestricted access to a pile of tools. Not a chatbot that happens to execute actions. An employable autonomous worker:
It knows its job. It knows what it's capable of. It knows what it's allowed to do. It knows where its authority ends. It can show you what it actually did. And when reality says its instructions are wrong — reality wins.
None of this is radical. It's how we've been employing humans all along.
Every state, quote and figure in this piece comes from the ticket's recorded event log — three worker runs, two blocks, one gate, one approval, one resume, about 60p of compute. The implementation that incident unblocked is next in the queue.