The decision record looked exactly like every other entry in the same log — same numbering, same format, same declarative confidence. AD-20 declared that composing a new Potion from scratch should be out of scope for the phone app. It stood for a full sprint before I caught it.
The problem was that AD-20 wasn't my decision. An agent had inferred a scope boundary during sprint 5 and logged it as if ratified. I reversed it explicitly with AD-27: "Composing on the phone is in scope… The narrowing traced to sprint 5's AD-20 — an agent's inference of product use, never ratified — which is struck."
The fix: one column
The process fix was AD-28. Every future decision record in that project got a provenance tag: [OPERATOR] or [AGENT]. An agent-authored scope inference is now marked a proposal rather than treated as binding until I've ratified it.
The app had roughly 29 named architectural and operator decisions logged across its 6 active days. From AD-28 on, one column says which ones I made and which ones an agent suggested. It costs one column.
Why it happened
The agent was doing its job — inferring from use and context — but the log gave it the same format and authority as my own decisions. The decision numbering (AD-1, AD-2, AD-3…) ran sequentially regardless of who made the call. From the outside, AD-20 read like policy.
The agents recorded architectural decisions as they went. Nothing marked which decisions were mine and which were their proposals. The format didn't require it, so the distinction disappeared.
The boundary has to live in what the tool checks
Put the boundary in the tool's contract, not just in a policy document an agent is supposed to remember. A flag the script literally requires, or a login screen with no session to reuse, stops an agent whether or not it "remembers" the rule that day.
LEGION refused a login it could have worked around. On 21 September 2026, a session needed two hosted operator consoles and found both signed out. It did not attempt to sign in itself; it finished every other item on the backlog and handed me the one remaining step: log in. LEGION's authority is tiered — routine actions (observe, any time, no gate), controlled actions (production mutation, requires the explicit flag the script demands), and destructive actions (delete, reset, rotate a secret, push a database to live — never run by an agent). The boundary lived in what the tooling checked, not in a written rule.
A written rule became a hook after it kept getting broken. My global instructions ban shell heredocs. In one working session on 21 September, the coding agent used a heredoc three separate times anyway, apologizing each time. I asked for the rule to be enforced on the machine; the agent wrote a 40-line pre-execution hook that denies any shell command containing a heredoc, and the next deliberate heredoc was refused before it ran.
The rule
When an agent keeps breaking a written rule, stop rewriting the rule. Move it into a check that runs before the action and cannot be talked out of.
Make authorship a field. If a decision log, an action log, a commit message or a change record doesn't say who decided it, you're one inference away from losing track of what you approved and what the agent proposed.
The provenance tag — [OPERATOR] or [AGENT] — is the simplest version. A login gate, a required flag or a pre-execution hook is the version that works when memory isn't enough. Either way, the boundary has to live in what the system actually checks, not in a paragraph an agent reads once and may or may not apply the next time.
The audio app shipped. It's on my phone. It landed 187 commits across 6 active days in mid-August 2026, with 1,211 test functions total (671 Rust, 540 Dart). AD-20 wasn't the only moment like this, but it was the last one. The systems I put in after it have done a pretty good job of separating what came from me from what the agents inferred.
Corrected 2026-09-29: the summary called this the one decision an agent made without permission, caught because every record says who made it → it was not the only one, and I caught it before the authorship tag existed (the tag was the fix); and other details that did not match the record.