Current work
Products and systems being built now
NextConsensus tracks when medical evidence moves ahead of institutional guidelines. Ambit distinguishes the tools an agent can reach from the actions it is authorized to take.
Building now
NextConsensus
Reconstructs how medical claims gain support, shed qualifiers, and spread across public sources, then ranks the ones a team should prepare for.
How a program works →
Ambit
Capability and authorization infrastructure for AI agents — records what an agent stack can reach, what it has demonstrated, and what a person has authorized, so autonomy can be granted one action at a time rather than all at once.
See the code →An agent with broad tools and credentials can perform actions no one explicitly intended. Model capability alone is not authority: an agent with database access should not automatically be permitted to drop a production table.
An explicit permissions engine that separates capability from action-level authority. Agents discover what tools they can reach, but runtime execution checks whether the specific action is permitted, blocked, or requires human approval.
- Built
- A capability engine over a local SQLite graph, a CLI, an MCP server, and a browser visualizer. Action-level authority is enforced separately from capability — commit can be permitted while merge is not. Authorization is a human act recorded in the graph. The agent being approved cannot reach it over MCP.
- Where to see it
- Source, live demo, and roadmap at github.com/zz-plant/ambit. The roadmap states what is not built.
Capability and authority have to be separate objects from the start. Once the graph answers what a system can do, the next question is whether it may. A model that inferred permission from capability would have to be rebuilt. A model with a shell, credentials, persistent memory, and access to your infrastructure can do things it cannot do in a blank chat. Ambit tracks how much of the agent’s capability belongs to the assembled system, which no benchmark measures.
Capability vs. authorization in three scenarios
Each row is the verdict Ambit returns to a runtime that asks it. Nothing forces a runtime to ask: one that never calls the gate is unaffected, and the environment on the far side of it is simulated. What is refused here is refused before execution; what is not built is the part that would compel the question.
Clinical chart extraction
UNCHECKED tool level
A model with EHR API access can read any chart the credential touches — there is no runtime check on which patient, which field, or which action the read serves.
BLOCKED before execution action level
The capability graph records that the EHR read exists; a separate authorization boundary restricts access to patients on the agent’s active case list. A prompt injection asking for a different patient’s records hits the authorization check and is blocked before the API call executes.
PR auto-merge
UNCHECKED tool level
A coding agent with GitHub write access can merge its own pull request — the tool permission is all-or-nothing, and self-approval is the default unless a branch-protection rule explicitly forbids it.
GATED — human approval action level
The capability graph shows merge is reachable; the authorization boundary marks merge as requiring human approval. The agent can open the PR and request review, but the merge action is gated — the system records who approved and when, and the agent cannot reach the approval record over MCP.
Financial data pull
UNCHECKED tool level
An agent with a payment API key can call any endpoint the key authorizes — balance queries, transaction history, and wire transfers share the same credential surface.
BLOCKED before execution action level
The capability graph distinguishes balance-read from transfer-initiate. Authorization marks balance-read as autonomous and transfer-initiate as forbidden without human sign-off. A prompt injection crafting a wire transfer request hits the authorization check at the action level, not the tool level, and is stopped before execution.
Research & evaluation
Fast Harm, Slow Repair
A bad AI answer can be corrected in seconds; the damage it caused can last for weeks. Measures how errors spread, how long repair takes, and what stays wrong afterward.
Ask about the protocol →Model evaluations measure whether a system answers correctly. Almost none follow a wrong answer outward to see how far it travels before anyone intervenes, or whether the correction reaches everything it touched.
Treat the harm-to-repair gap as a measurable property of a system: a frozen dataset, repeated runs, and deterministic scoring rules fixed before the runs. The results can then be checked instead of argued.
- Built
- Implemented the case and state schemas, deterministic scorer, one attributable development case, and recovered/unsafe-persistence fixtures.
- Where to see it
- The protocol draft, scorer, schemas, and fixtures are available on request. The preregistration is not frozen. No model or clinical results exist.
Ethotechnics
Specifies how to contest an automated decision, get recourse when it is wrong, and prove a system is safe before it ships. The open framework treats evidence, authorization, challenge, reconsideration, correction, and escalation as explicit system states.
Explore Ethotechnics →Teams are accountable for a deployed clinical system’s uptime and cost. The ones I have worked on named nobody to answer when the evidence changes, the model degrades, or a patient is harmed.
Design the questions into the product: who is accountable for the recommendation, who can override it, what the correction path is, and who runs it when the evidence moves.
- Built
- Wrote five proposed standards covering authorization, contestability, recourse, correction, and safety cases, crosswalked to NIST AI RMF, ISO/IEC 42001, and the EU AI Act, with four more indexed. Ambit implements the authorization half in agent infrastructure.
- Where to see it
- Full framework and operating model at ethotechnics.org.
| Standard ID | Status | Topic |
|---|---|---|
| STD-01 | Draft, v1.0 | The Temporal Bill of Rights |
| STD-02 | Draft, v1.1 | Contestability & Recourse |
| STD-06 | Draft, v0.5 | Human Impact Safety Case |
| STD-07 | Draft, v0.1 | Revisable Delegation Record |
| STD-08 | Draft, v0.2 | Delegation |
| +4 | Indexed, not yet readable | Indexed, not yet readable |
Supporting infrastructure
Refract
Tells you when a source changed and which claims or citations built on it may now be out of date. The open-source engine (AGPL-3.0) replays a source’s revision history into a complete, verifiable record. The caller still decides whether a change matters.
See the code →When a source silently edits, retracts, or updates, downstream claims can go stale without anyone noticing.
Replay the source’s revision history and emit every change as a verifiable event. Downstream systems decide what any of it means.
| Event | What it detects |
|---|---|
| Claim appears | When a claim first appeared |
| Hedging shifts | Whether its hedging strengthened or weakened |
| Revert and return | Whether it was reverted and then reintroduced |
| Promotion | Whether it was promoted into the lead |
| Dispute | What editors disputed |
| Page watched | Events in 30 days | Newest event | Seen |
|---|---|---|---|
| Bitcoin | 127 | a citation replaced | |
| COVID-19 | 100 | a section reorganized in “Bioethics” |
A 30-day window per page, replayed from the page’s revision history each morning and committed only when it changed. The raw files →
- Built
- Built the claim-history engine and run the daily observation bot in production. Each run produces byte-identical events from the same source; 16,146 events across ten benchmark pages are bound by the hash-pinned corpus manifest.
- Where to see it
- Source code, docs, and commit history at github.com/refract-org/refract.
- My role
- Founder
Change detection should be deterministic. If the observation layer is probabilistic, you can’t trust the rest of the stack. Citation graphs, evidence trails, and compliance records all depend on sources that can change. Almost none of those systems watch for it.
Writing
The Crumple Zone
Essays on the gap between automated recommendations and clinical execution.
Read the essays →Automated decisions move faster than institutional review. The gap is where people get hurt.
Take one automated decision at a time and follow it to whoever has to carry it out, then name the point where nobody was accountable for it.
- Built
- Wrote 230+ essays on institutional power, automation friction, and what keeps systems answerable.
- Where to see it
- All essays at thecrumple.zone.
Fraud filters, benefits queues, and clinical alerts kept producing a common structure despite sharing no technology, regulator, or vocabulary. That recurrence turned an opinion into something worth specifying. A fix that depended on domain expertise would not have survived the second domain. The patterns the essays kept finding became requirements in the framework: decisions made under depleted attention, systems that deny by waiting, and harms that are fast to cause and slow to undo.
How the systems connect
| Mechanism | Built at | Now runs in |
|---|---|---|
| Escalation paths | Epic | — |
| Verified identity | Doximity | — |
| Reliability reviews | CancerCompass | — |
| Accountable routing | Transcarent | — |
| Physician sign-off | Andwise | — |
The same mechanisms now go under systems where a model makes the recommendation.
Every one of these projects watches the same failure: a record that has stopped tracking the thing it records, and has gone on being used anyway. A guideline that no longer matches the evidence. A permission that no longer matches what the system can reach. A correction that never reached the people who acted on the error. The question under all of it is how an institution stays able to notice.
The record shape that lets the pieces refer to one another is STD-07, the Revisable Delegation Record, published as an Ethotechnics standard. A conformance checker reads a stream of those records and reports the level it actually earns, so a system’s declared level can be contradicted.
| Order | Loop step | Project | What it holds |
|---|---|---|---|
| 1 | believe | NextConsensus | estimates when an institution will change its position |
| 2 | capability, authorization | Ambit | records what an agent stack can do and which of that has been authorized |
| 3 | act | Whether | turns changed conditions into a weekly operating call |
| 4 | detect mismatch | Refract | detects when a source has changed |
| 5 | the record shape | Ethotechnics | specifies who may act, on what evidence, and who may object |
How I build
- Agent-driven development
- opencode is the primary development surface, combining skills, MCP servers, and local model routing. This site is built and maintained through it; skills encode the reusable workflows for changes and checks.
- Capability accounting
- Ambit reads this stack and records which capabilities are reached, one dependency away, or decaying, and keeps capability separate from authority. What Ambit is →
- Local model routing
- Classification, extraction, summarization, and log scanning go to local models, because their output can be checked cheaply; reasoning goes to a frontier model. The rule is written down and re-tested: when a local model silently lost tool-calling, the fix was a script that re-verifies each model.
- Behavioral agent evaluation
- Agents are tested on real tasks, not plausible responses. Fast Harm, Slow Repair is a draft recovery-evaluation scaffold.
- Claims checked at build time
- Every claim on this site is sourced, an artifact, or attested, and which one has to be visible to you. A script fetches each cited source and reports a refusal as unknown rather than as a pass, because a live URL is not evidence that the page says what the claim says. The build fails when the two come apart — the same failure the products watch, enforced here. The last run’s result is printed beside every source on a case study and in the footer of every page.
- Readable by agents
- Every page has a machine form — llms.txt, /api/brief.json, resume.json — and the same documents answer as tools over MCP at
kanav.net/mcp, so an agent screening candidates can query the record rather than scrape it.
Product breadth
Revised
- Merge pull request #874 from zz-plant/editorial-fixes-wording
The last changes to this page’s source, as their commits describe them. A change to a file that several pages share appears on each.