Two string fields decide how our AI agent's tool calls get from "the model wants to" to "it happened": (gate="defer_all", resolver="human") means every consequential call waits for the owner. Swap them and the same loop can run a locked-down product, an A/B arm, or a wide-open dev session. The agent can't read them, can't write them, and doesn't know they exist.

That's one seam, and this talk is about where seams like it belong in an agent harness. Which axes of behavior deserve a swappable strategy, and which should stay a single algorithm no matter how tempting the abstraction. Why picking the policy belongs to the code that launches the run, and never to the agent. What an interface turns into when its two halves run in different processes at different times. And how to prove a seam actually holds, because when ours failed, it failed open, silently, with every unit test green.

The pattern is thirty years old. The stakes aren't.