An accessibility map. A multi‑agent system. A web-based prompt library.

The projects above were implemented by AI agents working inside a governance system I designed: fifteen roles with explicit domain boundaries, and a written constitution that outranks any individual role or prompt. The agents do the implementation, the tests, and most of the diagnosis. I set the problem, make the architectural calls, and gate what lands.

The constraints are what make the output reviewable. Database migrations are files with a rollback, never applied changes: no agent applies one to production, or sends anything outside the repository, without my explicit authorization under a narrow, mechanically gated exception. None handles credentials. Exactly one of the fifteen may message me; the rest write to files I read on my own schedule. Merges to main are mine, with one narrow gated exception I granted to a single project.

Here is the system working. An agent fixing something unrelated added two background-location permission strings to app.json. The privacy role blocked it: the app uses no background-location APIs, so declaring them would invite an App Store 5.1.1 rejection and ask for a permission the product does not need. Both keys were removed; neither reached main.

And here is what it hands back. A review found that anonymous reports skipped a content filter that signed-in reports run. It was written up and deliberately left unpatched, because deciding what to filter on a submit form is a moderation policy, not a bug fix. It waited for me instead of being quietly patched, and the filter runs on both paths now.

The honest limit: these fences are prompt-level, not sandbox-level. It is one person’s system, tested across one person’s projects, and some of the governance overhead does not pay for itself.