Operations
Draft for human review
August 2026 · 7 min read
Before you trust an agent, make its work easy to replay.
When an agent’s output is surprising, a confident summary does not tell you what happened. A small review packet can.
The useful unit of supervision is not a chat transcript dumped on someone’s desk. It is enough evidence for a person to understand what happened and decide what happens next.
Agent systems can call tools, modify an environment, and adapt over several turns. That makes a polished final answer a weak audit surface. Anthropic distinguishes the transcript of a trial from its outcome: the transcript is the complete record of the run, while the outcome is the final state in the environment.[1] Keeping both changes the quality of the review conversation.
01. The summary problem
“Done” is a status, not evidence. An agent may say a record was updated when it was not; a coding agent may describe a fix that does not pass the intended test; a research assistant may produce a clean brief that drifts from its source material. The solution is not to make every person read every token. It is to decide what needs to remain inspectable.
OpenAI’s safety guidance recommends that people reviewing outputs have the information needed to verify them, including the original notes when a system summarizes them.[2] That principle generalizes: a reviewer should be able to compare a consequential output with the relevant input and the evidence behind it.
If a reviewer cannot reconstruct the decision, the workflow is asking for trust rather than earning it.
02. Build a review packet, not a surveillance archive
The goal is proportionality. A low-risk internal draft may need only the request, source links, result, and a named owner. A workflow touching production systems, sensitive data, or external communications needs a more deliberate boundary and review design. OpenAI’s governance cookbook describes using controls in proportion to a use case’s risk, rather than applying the same friction everywhere.[3]
The request
Keep the original task and any relevant source material. A reviewer needs to see what the system was actually asked to do.
The boundary
Record the systems, tools, and actions that were in scope—and the ones that required a stop or an approval.
The path
Keep a usable record of material tool calls, intermediate outputs, errors, and handoffs. Anthropic calls the complete record of a trial a transcript, trace, or trajectory.[1]
The result
Check the condition that matters in the environment: a passing test, a correct record, a prepared draft, or a clear escalation. A plausible final message is not the outcome by itself.[1]
The decision
Name who reviewed the work, what changed after review, and whether the case should become a regression check.
This is a planning framework from The Model Note, not a claim that one packet meets every technical, legal, security, or privacy requirement. The right record depends on what the workflow can access and affect.
03. Make review a short ritual
Start with a weekly review of one completed run and one failure or surprising outcome. Ask: did the final state match what was requested? Was the boundary clear? What did the person need that the packet did not show? Then change one thing: a tool description, a stop condition, a source requirement, or an evaluation case.
A 15-minute review agenda
- Read the request and the outcome before the agent’s summary.
- Inspect one decision point, tool call, or handoff that mattered.
- Name one failure, ambiguity, or exception in concrete terms.
- Choose one change to the brief, boundary, or evaluation suite.
- Leave with an owner for the next check.
The payoff is not perfect visibility. It is a team that can learn from real behavior before an unclear system becomes a hard-to-explain dependency.
Related decision
Build the five cases that make change visibleSources and review note
Read the material behind the note.
Fact-check status: source links reviewed against retrieved first-party pages on 22 Aug 2026. This is The Model Note editorial guidance, not legal, security, privacy, or operational assurance. Human editorial approval is required before public indexing.