Keeping an AI agent on course: design rules for a resident agent

A resident AI agent is one that keeps a standing job across many sessions, such as AR Labs' marketing manager agent, which runs continuously on a server and researches, recommends and prepares writing briefs for a person who writes and approves. An AI agent is a language model run in a loop with tools, so it can act, not only reply. Building such an agent is the first problem; keeping its work aimed at its job over weeks, as requests, findings and corrections arrive, is the second. This note sets out the ways we have seen a resident agent drift and the design rule we adopted for each. It is for anyone running an agent that works between conversations.

Why drift is a design problem

A model takes the move its context makes easiest, judged against whatever is most recent in that context. Over weeks, the context is what the agent's records and instructions make it. So drift is rarely fixed by rewording a prompt. It is fixed by changing what the agent is given: the assignment, the records it reads, the methods it is handed and the checks its work must pass. That is context engineering applied over time, and it follows our view in the harness paradox that useful autonomy grows inside a well-specified harness.

Seven kinds of drift and the rule for each

Drift	What it looks like	Design rule
No finish line	An open question is researched and elaborated indefinitely	Every assignment has a finish line and a date
Research as the only free move	The agent produces documents instead of the outcome	Give it a free move that produces the outcome; research serves a named decision
Accreting state	Each session reads every superseded decision again	One page of current state; history in git and a decision log
Thin briefs	A brief without a method returns an improvised method	Name the method in every brief, and have the agent read it
Checks of form	A filled-in template passes as a finding	Check results against sources, not summaries
Mirroring	The agent follows the latest input and cannot hold a line	Record decisions in exact words; a change of course is a new decision
Requests, not enforcement	A rule holds while the agent remembers it	Enforce what matters with a hook, a setting or a gate

Finish lines and free moves

An assignment without a finish line has no point at which more work stops being useful, so a capable agent keeps elaborating. Our marketing manager agent's role requires every goal to name an outcome, a measure and a time horizon, and its first assignment ends with a written "done when" list: the plan recorded with a method named for each step, the person's approval of its direction, and a fresh session able to resume from the records alone. A target date is a planning aid; it does not by itself mean the agent may work unattended.

The same agent's instructions tell it to continue through research, analysis and preparation without asking between steps, and to stop only for a decision, a missing contribution or an approval. Those steps include the ones that produce its outcome, writing briefs and preparing distribution, so research is never its only unrestricted move.

One page of current state

A working-state record tells a fresh session where the work stands. If it is appended to rather than rewritten, every superseded decision is read again as if it still held. When we audited the marketing agent's state file, notes on research method made up 943 of its 1,618 words, and each finding existed in three places. The design rule is that the current-work section is rewritten after each piece of work, names active records rather than copying them, and fits on about a page; the workspace's git history keeps the past. The same principle applies to instructions: when one rule appeared in five files in different words, our response was a design that gives each rule one home, on Gregory Bateson's logical levels.

Named methods, read in full

When a brief names a topic but not a method, the agent supplies the nearest method it has. With only part of a marketing method library installed, our marketing agent planned with a software planning skill; installing the whole library, and naming the method for each piece of work, closed the gap. Our coding pipeline met the same failure from the other side: an orchestrating agent asked to run the pipeline wrote its own lookalike of each step from memory. The rule there is that method travels by reading, never by restatement: a dispatched agent is told to open and follow the procedure file, not given a summary of it (see unattended agent runs).

Sources, not summaries

A check that tests form passes work whose substance is wrong. The marketing agent's plan states that completing the sections of a context template organises knowledge but does not validate demand, and it keeps facts, hypotheses and approved decisions apart, with each piece of evidence labelled measured, provided, calculated, estimated or proxy. When we verify its work, a separate session reads the saved material in its workspace against the sources it cites, and records what that reading did and did not repeat. The strategy agent's catalogue of failure modes names the same risk at the level of numbers: grading progress by an easy count that measures something else, such as open tasks, which rise with scope.

Holding a line

An agent that weights its latest input most heavily cannot keep to a direction the person set a week ago. Two of the strategy agent's named failure modes are versions of this: deciding from the most recent document instead of the authoritative one above it, and stating a boundary and then offering to cross it if the person agrees (see strategy agent planning cadences). The rule is that decisions are recorded in the person's exact words, with date and scope, in a log that is appended to and never edited. A change of course is then a new decision that names the one it replaces, not a drift in what the agent believes was agreed.

Enforcement, and gates that cost the person time

Instructions request; hooks and gates enforce. Around our coding agents, hooks deny edits the authority rules forbid. The marketing agent's runtime prevents it changing its own credentials and settings, while its rule for publishing, sending and spending is written in its instructions, because the runtime's approval mechanism covers risky system commands rather than business actions; an enforced check for those actions is an open design item.

Gates can also drift the other way. An agent can add review steps to its own plan until a committed outcome slips. Our rule is that a gate which delays an outcome the person has already committed to needs the person's yes to exist.

What exists today

Finish lines, named methods and source checks are part of the marketing manager agent's development plan and first assignment, and reading procedures rather than summaries is enforced in the coding pipeline. The append-only decision log and the levels design are accepted designs whose implementation is deferred. The strategy agent's guards against its failure modes are designs; today a person reviewing at each checkpoint performs them.