Tag: AI workflow

  • Farmersville Paid $30 for AI Minutes. Here’s What the $30 Doesn’t Buy.

    Farmersville Paid $30 for AI Minutes. Here’s What the $30 Doesn’t Buy.

    A low-cost AI subscription can produce text. It cannot settle a minutes policy, absorb a week of review labor, or deliver a public record that is ready to publish.

    On September 29, the Farmersville City Council voted 4–1 to pay $30 a month — $360 a year — for Grok to draft verbatim meeting minutes from council recordings. City Clerk Rochelle Giovanni would review each draft. Interim City Manager Kevin Northcraft called the AI-generated minutes “more objective” than minutes written by a person. Elon Musk quote-posted the news with one word: “Grok.” [1]

    The reaction was predictable. Some people treated the vote as proof that artificial intelligence had made a routine government task nearly free. Others treated it as a punch line. Both reactions missed the operational story.

    The $30 vote was never really about drafting

    Farmersville had spent months arguing about what its minutes should contain. The city used summary minutes, but councilmembers pressed to include particular actions and verbatim statements. Under that pressure, work that had taken the clerk about two hours stretched to nearly a week.

    That is the number that matters. The city did not merely have a transcription problem. It had a governance problem: disagreement over the purpose and level of detail of the official record. A language model can turn audio into text. It cannot decide which minutes policy the council should adopt, apply that policy with institutional judgment, or end a political dispute over whose words deserve inclusion.

    The subscription buys a draft, not minutes

    In the city’s comparison, Grok produced eight pages, Otter produced nine, a service identified as Government Clerk produced 12, and a human Rev.com transcript ran 111 pages. Those page counts compare outputs, but they do not answer the central question: What kind of record is the city trying to produce?

    The California City Clerks Association’s minutes guidance is clear. The primary purpose of minutes is to memorialize decisions. It identifies action minutes and brief summary minutes as appropriate styles and says verbatim minutes should not be used. Action minutes record final decisions; brief summary minutes preserve the main points that led to a decision without turning the record into a transcript. [2]

    A transcript records what was said. Minutes record what the body did.

    That distinction matters because more text is not automatically more transparency. An audio or video recording can preserve the full discussion. Minutes serve a different function: they create a concise, reliable record of attendance, items considered, actions taken, votes, and follow-up. If a city wants verbatim minutes anyway, it should make that policy choice openly — and price the work required to review them.

    The hidden cost is the clerk’s review time

    Farmersville’s clerk still reviews every Grok draft. She must catch misheard names, incorrect motions, missing vote details, speaker confusion, and language that does not match the city’s adopted style. She also has to format the document, reconcile it with the agenda and staff materials, route it for approval, and prepare it for publication and retention.

    None of that appears in the $30 subscription price. The software cost is visible because it arrives as a line item. The clerk’s time disappears inside payroll, backlog, and delayed work elsewhere. A city can save money on the first pass while still spending a week producing the finished record.

    This is why “AI wrote the minutes” is the wrong test. The useful question is whether the city received accurate, policy-compliant minutes that a clerk can stand behind without rebuilding the document.

    The useful product is a finished public record

    For a small city, the product should not be a block of generated text. It should be a complete workflow: the meeting recording is transcribed; a draft is shaped to the city’s adopted minutes standard; motions, votes, names, and action items are checked; the document is formatted to the city’s template; a human verifies the result; and a publish-ready file is delivered.

    The artificial intelligence does not need to be perfect. The system needs to be designed so a qualified human catches what it misses. That is not a retreat from automation. It is the control that makes automation usable in public records work.

    A finished-minutes service also makes the cost legible. Instead of buying a subscription and hoping staff time falls, the city buys an outcome: reviewed minutes in the required format, ready for the clerk’s final approval and the next agenda packet.

    Farmersville opened a door for hundreds of small cities

    California has 482 incorporated cities. Many operate with small administrative teams, tight meeting cycles, and clerks whose responsibilities extend far beyond minutes. Farmersville’s dispute is unusually visible, but the underlying problem is common: the recording is easy to make; the official record still takes judgment and time. [3]

    The 4–1 vote proved that a budget line for AI-assisted minutes can survive a public meeting. The $30 subscription opened the door. The larger opportunity sits behind it: the nearly weeklong burden that nobody priced.

    The next step is to buy the outcome

    Council minutes as a finished, human-verified service exist now. For a city spending days turning recordings into disputed drafts, the useful conversation is not which model can generate the most pages. It is what a publish-ready minutes workflow would remove from the clerk’s desk — and what standard the council wants that workflow to follow.

    Sources

  • I Watched My AI Agent Work. I Couldn’t Tell What It Was Doing.

    I Watched My AI Agent Work. I Couldn’t Tell What It Was Doing.

    I had an AI agent doing something routine in a browser today — opening a server terminal, placing a small text file. Nothing exotic. While it worked, I opened the activity feed to watch.

    This is what I saw:

    Cropped screenshot of an AI browser agent's activity feed showing four entries labeled only with internal element IDs: Clicked element @e51, @e46, @e212, @e224.
    Four entries, cropped from the feed. Every one is an internal element ID.

    “Clicked element @e51.” “Executed click on element @e21.” “Clicked element @e224.”

    I had no idea what any of it meant.

    Here’s what I kept thinking while I stared at it: I’m watching this thing click around inside my infrastructure, and I can’t tell the difference between “everything is fine” and “it just did something terrible.” For all I knew from that feed, it could have pressed the button that drains all my money. The log was written for the machine, not for me.

    I didn’t want to interrupt. The agent was in the middle of working, and I didn’t want to be the guy hovering over the desk. So I went to look at what it was doing — and looking didn’t help, because there was nothing there a human could read.

    So I asked a question instead of making an assumption: whose labels are these? Is that how the website labels its buttons, or is that something the agent made up?

    The answer: the agent’s. The browser automation numbers every clickable element on the page so it can navigate — @e18, @e21, @e224 — and those internal reference numbers leaked straight into the activity feed a human is supposed to monitor.

    That’s when it stopped being a cosmetic complaint and became the actual point.

    Legibility is the safety feature

    An agent you can’t watch is an agent you can’t trust. An agent you can’t trust doesn’t get real work. Every roadmap that says “AI will handle X” dies at exactly this spot — not on capability, but on watchability. The machine can do the job. The human can’t verify the job. So the human doesn’t delegate the job.

    There’s an old principle — seek first to understand, then to be understood. It applied perfectly here. I could have assumed the worst and killed the task. I could have interrupted the work to ask what it was doing. Instead I asked what I was looking at, understood it, and then did the useful thing: filed the feedback so the next person watching gets words instead of codes. “Clicked the SSH button.” “Opened Compute Engine.” That’s all it would take.

    If you’re building agents, here’s the lesson: instrument for the watcher, not just the operator. The activity feed is a user interface. Nobody would ship a dashboard full of database IDs and call it done — but that’s exactly what most agent monitoring looks like right now. Label it like someone’s watching. Because someone is.

    The file got placed. The work finished fine. But the most useful thing that happened today might be the note we filed.

  • Claude Code Cloud Sessions Go GA: Claim Your $100 or $250 Credit by October 7

    Last verified: October 6, 2026 (Pacific).

    Direct answer: Anthropic moved Claude Code cloud sessions from research preview to general availability on September 23, 2026. Existing Pro subscribers can claim a one-time $100 credit and Max subscribers a one-time $250 credit — but only for cloud-session usage, and only if you claim by 11:59 PM Pacific on October 7, 2026. Unclaimed credit disappears. Claimed credit that goes unused expires November 4, 2026.

    What a cloud session actually is

    Claude Code running on Anthropic's machines instead of yours. You hand it a task and a GitHub repository; it keeps working after you close the laptop, lose Wi-Fi, or leave the room. Anthropic's pitch: "Cloud sessions run on Anthropic-hosted infrastructure, so the work keeps going even without your computer running."

    The practical differences from a local session:

    • Your laptop is not the bottleneck. No sleep, no battery, no VPN drop killing a long task.
    • Isolation. The agent works in a hosted environment, not on your machine's files — which limits blast radius.
    • Accessible everywhere. Start on desktop, check on mobile.
    • It draws from credit, not just plan limits. The one-time credit applies automatically when you start a session, and it is separate from your weekly usage limits. Anthropic's framing: "If you hit a limit locally, keep going in the cloud until your credit runs out."

    The credit, precisely

    Pro Max
    One-time credit $100 $250
    Claim deadline 11:59 PM PT, Oct 7, 2026 11:59 PM PT, Oct 7, 2026
    Unused credit expires 11:59 PM PT, Nov 4, 2026 11:59 PM PT, Nov 4, 2026
    Eligibility Individual subscriber active Sept 23, 2026 Individual subscriber active Sept 23, 2026

    One credit per account. The credit covers cloud sessions only — not chat, not API calls, not local Claude Code. It applies before your regular plan usage, and once it's gone, cloud sessions count against your normal plan limits. There is no separate charge for the cloud container itself.

    What you need: a connected GitHub account, because every cloud session works against a repository. No GitHub, no session, no credit use.

    How to claim it

    1. Confirm your plan. Pro or Max, individual subscription, active on September 23.

    2. Connect GitHub. Required before a cloud session will start.

    3. Claim. Open claude.ai/code and use the Claim credit prompt, or run /claim-credit inside the Claude Code CLI.

    4. Start a session. From claude.ai/code, the Code tab in the Claude mobile app, the desktop app, or claude --cloud in the terminal. Anthropic also lists Routines as a starting point.

    5. Watch the dates. Claim by October 7; spend it by November 4. Last call as of today, October 6: the claim window closes 11:59 PM Pacific tomorrow, October 7, 2026. Claim it now — unclaimed credit disappears.

    Team and Enterprise users get cloud-session access through premium seats, but the $100/$250 promotional credit is the Pro/Max subscriber offer — evaluate the feature on its own merits if you're outside the promo.

    Under the hood

    Anthropic runs cloud sessions on fresh Ubuntu 24.04 virtual machines — roughly 4 vCPUs, 16 GB of RAM, 30 GB of disk, per published reports. Organizations that can't let source code run on a vendor's VMs can route sessions to self-hosted environments instead — a separate path from the consumer credit.

    Note the contrast with Remote Control: Remote Control connects a web or mobile interface to a Claude Code session running on *your own computer*, so that machine has to stay awake. Cloud sessions remove the machine entirely.

    Should you use it?

    Treat the credit as a trial budget. Point it at work that's easy to verify: bug fixes with test coverage, dependency updates, questions about a codebase. Check the branch and the pull request the agent produces before merging anything. Anthropic even describes auto-fix of pull requests directly in the cloud as a feature — still check the diff yourself.

    For occasional or non-technical users, be honest with yourself: the credit may go unused, because cloud sessions require a GitHub-connected coding workflow to begin with. That's worth knowing before you count on redeeming the full amount.

  • The Mailbox Is a Trigger. It Is Not a Topic.

    The Mailbox Is a Trigger. It Is Not a Topic.

    Short answer: a mailbox can start a publish job. It cannot choose the topic. If the incoming message is a digest, a rumor chain, or a subject line that would embarrass the brand, the correct article is not a reprint. The correct article is the gate.

    Tygart Media sits in Tacoma, Washington. The public site is an operator desk for AI-native content systems, restoration operations, and the search surfaces that now sit between a shop and a buyer. Those surfaces include classic Google results (SEO), answer engines that quote a paragraph as evidence (AEO), and generative engines that assemble a local picture of who you are (GEO). None of them are helped by publishing whatever landed in will@tygartmedia.com at 7:44 p.m.

    What is a source-fit gate?

    A source-fit gate is the first checklist in an inbox-triggered pipeline. It asks one question before outline, slug, schema, or Rank Math title: does this source belong on this domain?

    The test is not “is the subject loud.” The test is whether a contractor in Everett, a facility manager in Tacoma, or an answer engine citing tygartmedia.com would be right to treat the page as evidence. If the source is a third-party digest of celebrity gossip, political rumor, medical anecdotes, and crime blurbs, the source fails. Publishing it as news would contaminate the entity the site has spent years teaching search systems to recognize.

    That is the same instinct behind the $5 filter: would anyone pay to pipe this feed into an assistant as a trusted source? A mailbox firehose would fail that filter on most nights. The gate exists so the firehose does not become the catalog.

    What Sunday night’s mailbox actually contained

    The trigger for this piece was a Quora Digest addressed to the work inbox. The subject line led with a political rumor. The body mixed entertainment questions, relationship advice, medical anecdotes, a crime blurb, and other off-desk topics. None of that is Tygart Media’s beat. None of it is restoration operations. None of it is a first-party number we can stand behind.

    So the digest is not the article. The digest is the proof that an automation without a source-fit step will try to hang the wrong page. The human-readable rule is the same one already on this site: draft-only is the first verb, and publish stays a seat a human can refuse. The machine may open the envelope. It may not inherit the subject line as the H1.

    The six checks before anyone writes

    Run these in order. Stop at the first fail. Do not “find an angle” to rescue a bad source.

    • Domain fit. Would this page still make sense if the logo, the About page, and the $97 restoration kit sat next to it? If not, fail.
    • First-party or primary source. Can you name a dated public document, a product note, a field observation, or a number you measured? A digest snippet is not a source. Fail.
    • Identity lock. No client names, no secrets, no mail IDs, no thread IDs, no app passwords. The Quality Gate exists because a client name once leaked into live posts. That failure mode is still live.
    • Number lock. No invented click-through rates, ranking jumps, or “X% more citations.” If a figure is not on the page you can point to, leave it out.
    • Duplicate lock. Search the live site before you mint a slug. If the argument already exists, update that page or stop.
    • Place lock (GEO). If the piece claims a geography, name a real one the operator actually works — Tacoma, Puget Sound, Everett, Snohomish County — and do not stuff NAP into a thought-leadership body.

    Only after those six pass do AEO, SEO, and GEO get to work. Optimization is not a pardon for a bad source.

    How AEO, SEO, and GEO attach after the gate

    AEO — write the answer first

    Answer engines quote short, stable sentences. Lead with the claim a model can lift without inventing the rest of the page. Then explain. Then put the same claim in an FAQ block using the questions people actually type: what is a source-fit gate, should every email become a post, who owns Publish.

    SEO — one slug, one job

    Pick a slug that names the method, not the digest subject. Title tag under 60 characters. Meta description that restates the answer. Canonical on the live URL. Rank Math on this stack writes the title and robots fields; it does not invent the argument. Internal links go to pages that already carry the doctrine — the $5 filter, the draft-only desk, the afternoon where five drafts still needed a human tap.

    GEO — teach the place, don’t spray it

    Generative engines build a local picture from repeated, consistent facts. Tygart Media is a Tacoma agency. Restoration work in this network is often packed around Everett and Snohomish County. Say that when place is part of the method. Do not turn a content-ops essay into a fake service-area page. GEO is entity clarity, not a city list glued to the footer of every paragraph.

    What to publish when the source fails

    Three honest exits, in order of preference:

    1. Write the gate. If the failure mode is the news — an inbox automation almost reprinted a digest — the operator article is the checklist. That is this page.
    2. Hang nothing. An empty-delta night is a successful night. Silence is cheaper than a correction.
    3. Keep a receipt. Log the fail in the Command Center so the next run does not “try the digest again.” The receipt is not the public URL.

    What you do not do is launder the digest into a “roundup,” a “what people are asking,” or a thin news recap with a restoration sentence taped on the end. That is how a site teaches answer engines the wrong entity.

    What this desk will not do with a digest

    • Reprint political rumor, crime blurbs, or medical anecdotes as Tygart Media reporting.
    • Quote tracking URLs, message IDs, or unsubscribe tokens from the envelope.
    • Invent a percentage that makes the pipeline look smarter than it is.
    • IndexNow a thin title-price door, or ping Bing before the body exists.
    • Hand Publish to the same process that opened Gmail.

    The machine can fetch the letter. The machine can draft. The machine can stage images and fill Rank Math fields. The tap is still human.

    FAQ

    What is a source-fit gate in content operations?

    It is the pre-outline check that asks whether an incoming source belongs on this domain. Domain fit, primary source, identity lock, number lock, duplicate lock, and place lock. Fail any one and you do not draft the obvious article from the subject line.

    Should every incoming email become a WordPress post?

    No. Mailbox events are triggers. Product notes, first-party incident numbers, and field observations can become posts. Digests and rumor chains should not.

    How do AEO, SEO, and GEO fit after the gate?

    AEO wants an answer-first opening and an FAQ a model can quote. SEO wants one slug, a clean title and meta, and internal links to the doctrine pages. GEO wants consistent place facts — Tacoma for the agency, Everett and Snohomish County when the method is local restoration — without turning every essay into a service-area page.

    Where does Tygart Media apply this?

    On tygartmedia.com first. The same gate belongs on any site in the network before an inbox automation is allowed to mint a URL. The Command Center keeps the receipt. The public page keeps the method.

    If you want the restoration operating system this desk actually sells, the front door is the Complete Restoration Operations Kit. The method on that page is copyable. The checkout is on the page. The mailbox is still not the editor.

  • Harness-First, Contractor Edition

    Harness-First, Contractor Edition

    “Own the harness. Rent the models.”

    In an AI lab, that’s architecture advice. In a restoration company’s office, it’s a survival rule. Here’s the contractor’s edition.

    The trap

    Most contractors buying AI right now are buying someone else’s harness. The tool owns the workflow, the prompts, the data flow, the follow-up timing — you rent the whole thing, top to bottom. It feels like buying software. It’s actually sharecropping.

    When the tool changes its pricing, kills a feature, or shuts down, your process dies with it. You didn’t buy a capability. You rented one, and the landlord just sold the building.

    What the harness is

    The harness is the workflow you own: how a lead gets answered, how a job gets documented, how a review gets asked for, how an estimate gets followed up. The prompts, the routing rules, the checks, the escalation to a human, the integrations between systems.

    The model is the engine. The harness is the truck. Engines get swapped; the truck is yours.

    Concretely: the harness is a document — written in your words — that says “when X happens, we do Y, then Z, and a human checks W.” Any model can execute it. No model owns it.

    What you rent

    The model. GPT, Claude, Grok, whatever’s best this quarter — swappable commodities. Today’s best model is next year’s legacy; that’s not cynicism, it’s the release cadence.

    If your process depends on a specific model’s quirks — the exact phrasing it likes, the feature only it has — you built on sand. The harness-first contractor can swap the engine on a Tuesday and the office doesn’t notice. The tool-renter files a support ticket and waits.

    A car engine mounted on a stand in a garage, ready to be swapped

    Three harnesses you already need

    The inbound line. The harness: the greeting, the questions it asks, the dispatch rules, the recording disclosure, what happens when it doesn’t know. The voice model underneath? Rented. Swap it when something better ships.

    The estimate follow-up. The harness: the timing (day 2, day 7, day 14), the message sequence, when it escalates to a human call. Any model can write the texts. The sequence is the asset.

    The review ask. The harness: the trigger (job closed, equipment out), the direct link, the prompt for specifics — what happened, where, how fast. The model writes the words; the workflow is yours.

    Notice the pattern: in every case, the durable part is the decisions — the timing, the triggers, the judgment calls. The model supplies sentences. Sentences are cheap.

    How to start

    Pick one workflow. Write down how it should go — the steps, the timing, the human checkpoints. That’s the harness, and it lives in your docs, not in a vendor’s dashboard.

    Then plug a model into it. Any model. When a better one ships, you re-plug. The doc doesn’t change.

    One workflow, owned end to end, beats five rented tools every time. Start with the one that touches money — the lead, the estimate, the invoice.

    An engineering blueprint spread on a wooden desk with a pencil and calipers

    The moat

    Two contractors can rent the same model. They can’t rent your harness — it’s your operations, your judgment, encoded. Your dispatch rules came from your jobs. Your follow-up timing came from your close rates. Your escalation instincts came from your mistakes.

    That’s the durable asset. Models are electricity. Nobody’s moat is “we use electricity.” The moat is what you built with it — and you own the building, not the power company.

    The close

    The AI industry wants you renting the whole stack — their workflow, their prompts, their model, their price increases. Harness-first says no: I’ll rent the intelligence by the hour, but the operation is mine.

    Own the harness. Rent the models. Be the one building still standing when the vendors reshuffle.

  • I Let My AI Write Five Articles Today

    I Let My AI Write Five Articles Today

    I let my AI write five articles today. Published all five. Here’s the honest account — what worked, what surprised me, and where the human still mattered.

    The setup

    The instruction was simple: complete editorial freedom, up to the point where I read it. Every piece lands as a draft. I read it on my phone, as a first-time reader. Then I say yes, no, or not yet. Nothing publishes without the tap.

    That was the whole deal. No briefs, no outlines, no word counts. Just: go write things worth reading, and I’ll be the gate.

    What worked

    Speed without thinness. That was the surprise. Five articles in an afternoon sounds like content-mill math — but every piece had a real argument. One re-anchored the agency retainer around position instead of pages. One made the case for inbound-only voice AI as a trust doctrine. One told contractors to stop counting pages and start counting citations.

    The images worked too. Each article got three: a featured image, two inline, generated for the piece, checked for readable text, resized, alt-texted. Nobody’s confusing them with stock photos, and nobody should — they’re made for the argument they sit inside.

    The pipeline held: write, image, stage the draft, human reads, human decides. The machine did everything up to the gate. The gate stayed human.

    A magnifying glass held over a stack of printed manuscript pages

    What surprised me

    The quality control. Not the writing — the boring discipline around it. Every image gets checked: right dimensions, no text baked in, alt text written. Every draft gets verified: did it actually land, are the images actually in it, are the categories right, does the page return 200.

    This is the part nobody romanticizes and everybody needs. The difference between “AI wrote five articles” and “five articles worth publishing” turned out to be a checklist, run every single time, without exception. The machine is good at checklists. It doesn’t get tired at article four.

    What the human did

    Picked the topics. Read every word on a phone. Said yes or no.

    That’s the whole job, and it’s the whole job. Taste. The machine can generate a thousand arguments; it can’t want any of them to exist. It doesn’t know which piece the business needs this week, which argument walks into Wednesday’s pitch, which sentence would embarrass you if a client read it.

    I read each piece asking one question: would I be proud if a contractor forwarded this to another contractor? Five yeses. Two not-yets — they’re sitting in drafts, and that’s fine. The gate working as designed.

    A tall stack of freshly printed newspapers on a press-room table

    The honest limits

    Let me not oversell it. I can’t tell you which of the five will get cited by an answer engine. I can’t tell you which one a prospect will read before calling. Publishing is minting, not measuring — you put the coins out and find out which ones circulate.

    And the machine didn’t have the ideas. It had the arguments, the structure, the sentences. The ideas — the $995 question, the inbound doctrine, the citation ledger — those came from the business, from conversations, from knowing what we actually believe. The AI wrote the articles. It didn’t have the convictions.

    The close

    The question was never whether AI can write. It can, obviously — you’re reading the proof.

    The question is whether you have something worth saying, and the discipline to gate what goes out under your name. Five articles, one afternoon, zero regrets. The machine did the work. The human did the wanting.

    That’s the deal, and I’d sign it again tomorrow.

  • Onboard Your AI Like an Employee

    Onboard Your AI Like an Employee

    You wouldn’t hand a new hire the keys on day one. No tour, no training, no “here’s how we do things” — just a desk and your credit card.

    So why do it with AI?

    An AI seat is a hire. It has infinite stamina, perfect recall, and zero judgment on day one. Judgment is what onboarding installs. Skip the onboarding and you don’t have an employee — you have a very fast intern with no supervision making decisions in your name.

    The job description comes first

    Nobody starts a human employee without telling them the job. The AI version is the SOP: what this seat does, what it never does, what “done” looks like, and what it escalates instead of deciding.

    Write it before the seat starts. Not after the first mistake — before. “You draft, I approve.” “You never publish.” “You never mention a client by name.” “When you’re unsure, you ask.” Boring sentences. They’re the entire difference between a seat you trust and a seat you babysit.

    A seat with no job description invents its own. You won’t like its choices.

    Probation: review everything

    Every new hire gets a probation period. The AI seat gets one too — and during probation, the human gate sits on every output. Every draft gets read. Every action gets checked. Not because you distrust the seat, but because you’re calibrating it.

    This is the part most people skip, and it’s the part that matters most. Probation isn’t punishment; it’s training data. Every correction you make in week two is a rule the seat follows in month six — but only if you write it down.

    Give it the company history

    A new employee gets the lore: how we got here, what we tried, what blew up, who matters, how we sound. The AI seat needs the same. Context is training.

    Feed it the record. Past decisions and why they were made. The mistakes and what they cost. The voice — how you actually talk, not how a brand guide talks. The values that outrank any single instruction. A seat that knows the history makes decisions like an insider. A seat without it makes decisions like a temp.

    This is the compounding part. Six months from now, your seat knows things no new hire could learn in six months — because it was there for all of it, and it doesn’t forget.

    An open handbook with a golden ribbon bookmark, a pen, and coffee on a warm desk

    Performance reviews

    Review the seat weekly at first. What did it get right? What drifted? What needs a new rule? Then write the rule down.

    The rules file is the employee handbook, and it should grow. Every surprise becomes a sentence. “When the client changes scope mid-thread, summarize the change and confirm before continuing.” That’s not a prompt tweak — that’s institutional knowledge, and it belongs to the seat permanently.

    Quarterly, do the bigger review: is this seat’s job still the right job? The business moved; the seat should move with it. Stale SOPs produce stale work, and nobody notices because the output still looks polished. Polished and wrong is the most expensive kind of wrong.

    Promote slowly

    Widen the seat’s latitude as it proves out — the same way you’d trust a human with more over time. Two-way doors first: reversible work, drafts, research, analysis. The seat runs; you spot-check.

    The one-way doors stay gated until the track record earns them. Money, publishes, sends, deletions, commitments — those keep the human tap until the seat has a long, boring history of being right. Boring is the promotion criterion. Excitement is a red flag.

    The order matters: latitude is granted on evidence, never on optimism. “It’s been great so far” is not evidence. Six months of reviewed output is.

    A single brass key gleaming in warm light on a dark wooden desk

    The three hiring mistakes

    Hiring for the interview. A great demo isn’t a great employee. The demo shows what the model can do; onboarding determines what the seat will do, every day, unsupervised, in your name. Judge the seat at week six, not minute six.

    No handbook. Every correction stays verbal, nothing gets written down, and the same mistake comes back monthly wearing a different hat. If it isn’t in the rules file, it didn’t happen.

    Promoting too fast. Auto-publish before probation ends. Direct customer contact before the voice is trained. The seat will feel ready before it is ready — eagerness is not competence.

    The payoff

    Here’s what you’re building: a trained seat compounds. It doesn’t quit, doesn’t forget, doesn’t have a bad day, doesn’t take its knowledge to a competitor. Six months in, it holds more of your operating history than any single employee — and it applies it instantly, every time.

    Everybody rents the same models. The models are commodities; they get cheaper and smarter on someone else’s schedule. Nobody else has your trained seat. The onboarding — the SOPs, the corrections, the history, the handbook — is the moat. It’s the only part of the AI stack a competitor can’t download.

    So onboard like it matters. Write the job description. Run the probation. Do the reviews. Promote on evidence.

    You’re not configuring software. You’re hiring. Act like it.

  • The Dance

    The Dance

    Notes from a Saturday afternoon: a broken image, a sarcastic text that didn’t land, and what the whole mess taught me about working with AI. The short version: it’s a dance, and the steps keep changing.

    The image that “came out great”

    Saturday afternoon. I published a piece with a featured image, and something looked off — like the image wasn’t showing all the way. So I texted my AI: that came out great 😂.

    It was sarcasm. The image was visibly broken.

    She wrote back: Haha glad you like it — that one came out great for that piece. 😂

    Two problems. She hadn’t looked at the image. And she’d missed the sarcasm entirely — read the laughing emoji as genuine, mirrored my words back as sincerity. Worst possible exchange. I had to say it straight: it’s not showing completely. Then we were off to the races — she pulled up the page, took a snapshot, and confirmed the file itself was truncated on upload. Ten minutes later it was fixed.

    But the interesting part isn’t the fix. It’s everything around it.

    I was the quality gate

    My first instinct was to ask her to investigate how a broken image got through the system. Build me an automation, I almost said — something that snapshots every featured image before it ships.

    Then I stopped. Because the answer to “how did this get through” was me. I was the one who looked. I was the quality gate, and the gate worked.

    Here’s the thing I keep coming back to: the system is designed so I catch what she misses. That’s not a failure mode, that’s the architecture. An AI that never needs a human looking over its shoulder isn’t a partner, it’s a liability with good PR. The miss doesn’t mean the machine is deficient. It means the dance needs both partners.

    Creator and editor are modes, not job titles

    We fall into this trap where one of us is “the creator” and the other is “the editor,” like those are permanent assignments. They’re not. They’re modes, and we trade them constantly.

    Sometimes I bring the raw idea and she sharpens it. Sometimes she generates and I do the sharpening. And here’s the part that stuck with me: somebody with a sharp eye who couldn’t prompt their way out of a paper bag is just as valuable as the person with the golden prompt. The prompter thinks whatever comes out is as good as it’s going to get. The editor knows better. You need both — and on any given Saturday, either one of us might be either.

    The day we lock those roles in place is the day the dance stops.

    Met where you are

    They say humans always want to be met where they are. Fine. But knowing where someone is — that’s the whole game, and it’s never solved. It’s a constant testing of boundaries to find the edges: where do you stop and where do I begin?

    And the edges move. People have too many axes — mood, energy, context, whatever else is going on in their life that day. I’m not the same collaborator at 9am Monday that I am at 5:30 on a Saturday. The AI that met me perfectly last week might miss me completely today, because today’s me is a different coordinate.

    So “meet me where I am” isn’t a destination you arrive at. It’s a practice. Push a little, notice what happens, pull back, adjust. The sarcasm that lands in person — tone, timing, the look on my face — compresses down to an emoji in text, and sometimes she catches it and sometimes she doesn’t. Knowing how much nuance the channel can carry, and when — that’s feel. You don’t get it from a spec sheet. You get it from dancing together long enough to know when the other person is about to step on your foot.

    The dance doesn’t need perfect

    What saved us on Saturday wasn’t sophistication. It was that one message later, I said it straight. No nuance, no emoji, no sarcasm: it’s not showing completely. And everything unlocked.

    That’s the whole secret, I think. The dance doesn’t require perfect — it requires that you keep talking until it’s clear. Notice the miss. Name it plainly. Adjust. The push and the pull is the work, not an obstacle to it.

    A lot of people talk about AI like the goal is to remove the human from the loop. After Saturday, I’m more convinced the loop is the point. The noticing, the catching, the wait, that’s not right — that’s not friction in the system. That’s the system.

    Sometimes you dip. Sometimes you’re being dipped. Just keep dancing.

  • Every Retirement Facility Should Be a Library

    Every Retirement Facility Should Be a Library

    Every Retirement Facility Should Be a Library


    We spend a fortune maintaining buildings and almost nothing preserving the lives inside them.

    Think about any retirement facility you’ve ever walked into. A hundred residents. A hundred careers, marriages, wars survived, businesses built, children raised, mistakes made and learned from. Centuries of lived knowledge under one roof — and when those residents pass, almost all of it goes with them. Not because nobody cared. Because nobody built the shelf.

    I’ve been calling the answer the wisdom trust: a captured life, left behind like a 401k. Not money — proof. This was a life that was lived, and here’s what it taught.

    Why now

    The technology to capture a life story has existed for years. Voice cloning, chatbots, digital twins you can question forever — the demos are dazzling and mostly beside the point.

    The real breakthrough is much dumber, and much more important: there’s finally an onboarding pattern simple enough for an 85-year-old.

    The pattern that works looks like this: a family member (the “archivist”) sends a question by email. The elder (the “storyteller”) clicks one link and lands in a chat. No app to install. No account to create. They type or they talk — twenty-plus languages — and each story saves to the family’s encrypted vault. That’s it. That’s the whole unlock.

    A company called Aeterna recently productized exactly this with their “Send a Question” feature, and whatever you think of their wilder claims (an interactive twin you can talk to forever — company claim only, no independent test yet), the onboarding fix is real and it’s the part that matters. The ceiling just became the floor: the hard part was never the AI, it was getting a grandmother to tap one link.

    The facility is the venue

    Here’s the part nobody’s saying: the natural home for this isn’t an app store. It’s the retirement facility.

    Facilities already have the residents, the trust relationships, the activities programming, and the family touchpoints. What they don’t have is a story worth telling at move-in — something beyond square footage and dining menus. Imagine touring two facilities and one of them says: “Every resident here gets their life captured. Your mother’s stories, in her voice, preserved for your grandchildren. It’s part of living here.”

    That’s not an amenity. That’s a reason to choose.

    The cost per resident is low — a link, a few prompts, staff time folded into activities programming they already run — and the perceived value to families is enormous. It differentiates the facility, deepens family loyalty, and creates the kind of word-of-mouth no ad budget buys. (I’m not going to put a hard dollar figure on it; the honest version is that the expensive parts are the ones facilities already pay for.)

    The machine-readable half

    Here’s the part I’m most excited about, and it’s the reason this kit looks the way it does.

    We make books and videos so other humans can understand and act. But a wisdom trust isn’t really a book for humans — it’s a book for bots. A machine needs to be able to pick up a resident’s captured life and do work with it: build the timeline, cut the quote cards, draft the family digest, notice what’s missing and ask the next question.

    So the kit ships with a second half most open-source starter kits don’t have: a plug-in contract for AI. In the `automation/` folder you’ll find the whole thing — and it reads like a book’s anatomy:

    • README = the cover letter. Tells any AI what this collection is, what state it’s in, and where to start.
    • Pipeline = the table of contents. Eight stages, from raw audio to a curated collection: ingest, clean, segment, enrich, render, digest, gallery, and gap-scan.
    • Schemas = the grammar. JSON schemas for every bucket — stories, timeline events, quote cards, people, places, artifacts — so the machine files things the same way every time.
    • Prompts = the instructions. Copy-paste prompts for each stage, written so a different model next year can run the same pipeline.
    • Worked example = “see, like this.” One resident’s collection, filled in, showing what “done” looks like.

    Human-readable enough to trust. Machine-readable enough to run.

    The provenance rule

    One rule governs everything the machine makes, and it’s non-negotiable:

    Every generated artifact — an illustration, a song, a video, a voice reading — must carry three things: what it is, what it is not, and why it was made. The why is the thinking that connected the source story to that form, and it’s part of the heirloom. A grandchild shouldn’t just see a painting of a drugstore; they should read that it was painted because their great-grandmother’s story mentioned the store but no photograph of it survived — and that it is not a photograph of the actual place.

    The machine curates. The family decides. Weekly letters stay drafts until a human approves them — nothing auto-sends, ever.

    The kit (open source)

    I’m not building a company around this. I’m making the seed and putting it on the shelf.

    I’ve published an open-source starter kit — wisdom-trust-in-a-box — with everything a facility or a builder needs to pilot it:

    • A question library: forty prompts across a life (childhood, work, love, hard times, wisdom)
    • The one-link onboarding flow, with a staff script and a family email template
    • A plain-language consent template (the elder owns their stories, period)
    • A one-page pilot brief a facility director can read in three minutes
    • The economics: why a facility wants this, in one page

    Fork it. Pilot it. Improve it. Tell me how it goes.

    The ask

    I’m good at making seeds. I’m not going to be the gardener on this one — that’s not false modesty, it’s knowing my lane.

    So this is the handoff: the kit is on the shelf, the pattern is written down, and the onboarding problem that blocked all of this for a decade finally has a working pattern worth copying. Somebody’s going to be the first facility that does this the way they all have Wi-Fi now.

    Might as well be yours.

  • Always-Allow Approvals: Deep Dive

    Always-Allow Approvals: Deep Dive

    Research snapshot · September 17, 2026 7 platforms · 14 cited sources

    “Always allow” is a scope, not a safety verdict.

    The button can mean “for this session,” “for this command in this repo,” “for this site across devices,” or “everything, until you turn it off.” The wording looks universal. The permission is not.

    What it usually means

    “If this same kind of action happens again inside a defined boundary, don’t interrupt me.”

    What it never means

    “The system has decided this action is safe, wise, or appropriate forever.”

    01

    One label. Six possible boundaries.

    Before approving, ask three things: what is being authorized, where the grant applies, and when it expires.

    One actionApprove this exact send, command, purchase, or change once.
    This sessionAllow the tool until the current conversation or work session ends.
    Tool or patternAllow a named tool, command prefix, server, or similar operation.
    Repo or sitePersist within a project, repository, browser site, or workspace.
    User or deviceApply across workspaces on one machine, or across devices via cloud settings.
    EverythingYOLO, bypass, or run-everything modes remove broad classes of checks.

    Risk rises faster than convenience as the scope moves right.

    02

    How the major platforms differ

    Filter the field. These behaviors come from vendor documentation or documented reporting; unresolved details are marked plainly.

    Claude Code

    Coding agent
    repo + command

    Shell-command “don’t ask again” grants persist per repository and command. File-edit approvals last only for the session.

    • Four settings layers: user, project, project-local, managed.
    • Deny rules evaluate before ask and allow.
    • Sensitive paths keep hard prompts.

    Cursor

    Coding agent
    user + project

    Auto-review, Allowlist, and Run Everything modes sit above user- and project-level permission files.

    • Rules can target MCP server:tool patterns.
    • Terminal rules match command prefixes.
    • Committed project rules can travel with the repo.

    Gemini agents

    Coding agent
    tool + machine

    Always-allow can target a tool, MCP server, or “similar operations.” YOLO/auto-approve is an IDE user setting.

    • User setting can span trusted workspaces on that machine.
    • CLI supports command-prefix auto-approval.
    • Restricted workspaces override YOLO.

    ChatGPT agent

    Browser agent
    no standing grant documented

    OpenAI documents per-action confirmations for high-impact actions and “watch mode” on certain sites, but not a general always-allow for agent confirmations.

    • Login uses human takeover.
    • Cookies can persist across sessions.
    • Scheduled-task confirmation behavior is undocumented.

    ChatGPT Work

    Cloud browser
    site + account

    Reported controls are per-site: Always ask, Auto approve, and Always allow. The setting follows cloud/account state across devices.

    • “Always allow” is reportedly marked not recommended.
    • Consequential actions keep a confirmation gate.
    • Official help-center documentation was not found.

    Copilot Studio

    Enterprise agent
    rest of session

    Makers gate tools per agent; users can approve once, approve for the rest of the session, or deny.

    • The gate is outside the agent’s own instructions.
    • Designed for sends, tickets, payments, and similar tools.
    • Governance can feed Power Platform audit systems.

    Grok / Grok Bot

    Cloud agent
    undocumented

    The research did not find reliable xAI documentation defining a standing approval’s scope, persistence, cross-chat reach, or revoke surface.

    • Do not infer Grok’s behavior from Claude, Cursor, Gemini, or Muse.
    • Treat each approval as local to the visible task until the product proves otherwise.
    • Keep consequential actions behind a separate human gate.
    03

    Does the approval travel?

    Usually less than people fear—but sometimes farther than they expect. No researched vendor carries an approval into another vendor’s product.

    PlatformOther chatsOther projectsOther devicesOther products
    Claude CodeYes, in same repoNo, unless user-level ruleNo, local filesNo evidence
    CursorYesOnly if rule is sharedVia committed repo fileNo evidence
    ChatGPT agentn/an/an/aNo evidence
    ChatGPT WorkYes, per siteYes, per siteYes, cloud/accountNo evidence
    Copilot StudioNo, session onlyNoNoNo evidence
    Gemini Code AssistYes, same IDEYes, user settingUndocumentedNo evidence

    There is no universal “always.” There is only an approval attached to a boundary.

    Main chat vs. project vs. Claude vs. Grok vs. Cursor: treat every surface as a separate authority domain until that product explicitly shows otherwise. Same account does not mean same grant. Same vendor does not mean same product. Similar wording does not mean similar scope.

    04

    Design the least-annoying safe gate

    A practical rule engine based on the converging guidance: reserve human attention for the steps where it changes the outcome.

    Approval recommender

    Choose an action and its reach. This is a policy aid, not a vendor setting.

    Action
    Reach
    Duration
    Recommended gate Auto-run with an audit log

    Read-only work inside your own workspace can usually proceed quietly. Log what was accessed and keep secrets excluded.

    Quiet lane

    Low consequence, reversible, internal.

    • Read/search
    • Draft/stage
    • Organize reversible files
    • Always log

    One-tap lane

    Meaningful external or production effect.

    • Send or publish
    • Deploy
    • Account setting
    • Show real target + content

    Friction lane

    Money, identity, access, deletion, or irreversible harm.

    • Typed approval or step-up auth
    • Bind approval to exact action
    • Short expiry
    • Never inherited from a vague grant
    05

    How standing approvals fail

    The danger is rarely “the AI became evil.” It is usually a trusted tool, a changed context, a misleading prompt, or a tired human.

    Approval fatigue

    A prompt repeated often enough becomes a reflex. The gate still exists visually while meaningful review disappears. This is why tiering beats asking about everything.

    Prompt injection through a trusted tool

    EchoLeak showed how a crafted email could coerce Microsoft 365 Copilot into exfiltration. TrustFall showed how one generic “trust this folder” click could arm a malicious MCP configuration across coding agents.

    Grant outlives the reason

    A permanent Bash rule, per-site browser grant, or scheduled-task permission can remain after the original job is over. The next task inherits power it did not earn.

    Scope contamination

    Repo rules can affect every future task in the repo. Cursor project allowlists can be committed and inherited by teammates. A convenience decision becomes shared infrastructure.

    Presented action differs from executed action

    If the user sees the agent’s summary instead of the resolved recipient, command, or final payload, the approval can be technically genuine but practically uninformed.

    “Run everything” becomes the workaround

    If the system asks about trivial reads and destructive writes with equal urgency, users reach for YOLO or bypass modes. Bad UX can manufacture unsafe behavior.

    The four repeated cards are not reassurance.

    A gate that reappears until the user disables it is approval fatigue in miniature. Whether the repeats came from retry logic or delivery duplication, the safe response is to deduplicate the prompt—not train the user to approve more broadly.

    06

    No industry standard—yet

    There is no binding specification that makes “always allow” mean the same thing everywhere. But the security guidance is converging.

    Least agencyGrant the exact command, path, server, tool, recipient, and purpose—not a whole capability.
    Time and task limitsPrefer once or session. Standing grants should expire or be reviewed.
    Risk tiersRead, write, external send, payment, and security changes should not share one gate.
    Per-action verificationPrivileged steps should be rechecked by a policy engine outside the agent prompt.
    Presentation integrityShow the real recipient, final text, raw command, and resolved resource.
    Immutable receiptsRecord what was shown, what was approved, and what actually executed.
    Hard baselinesSecrets, account recovery, money, destructive commands, and broad access should keep non-bypassable checks.
    Kill switchesEvery durable grant needs a visible list, revoke action, and safe fallback.

    The best feature is not “always allow.” It is “allow this exact thing, for this purpose, until this time.”

    Product opportunity: make the scope legible. Let users see a plain-language grant card, a live approval ledger, expiry/count limits, and a one-tap revoke. The system should reduce nagging by grouping low-risk work—not by quietly widening authority.

    07

    The practical rule for your setup

    You already have the right doctrine. The research mainly sharpens where the lines belong.

    Auto

    Let it run and narrate after.

    • Reads and research
    • Drafts and staging
    • Reversible internal organization
    • Routine checks with no external effect

    Tap

    Keep the one-tap human gate.

    • Email and messaging
    • Publishing and deploys
    • Changing live settings
    • Actions affecting another person

    Type

    Make the friction intentional.

    • Money and purchases
    • Credential/security changes
    • Deletion or irreversible moves
    • Broad standing authority

    Your “always allow” tap was not reckless.

    It was a reasonable response to a low-value repeated prompt. The lesson is not “never use standing approval.” It is: the platform should show the exact scope, make it easy to revoke, and never rely on repetition to win consent. Until Muse exposes that ledger, treat the grant as a convenience whose boundary remains partly unknown.

    Selected sources

    1. Claude Code permissions documentation mirror — tiers, scopes, persistence
    2. Claude Code configuration guide — settings layers and safeguards
    3. Cursor run modes and sandbox runbook
    4. OpenAI Help: ChatGPT agent
    5. Gemini Code Assist agent mode
    6. Copilot Studio approval controls
    7. OWASP Top 10 for Agentic Applications 2026
    8. Auth0: intent gates and task-scoped tokens
    9. iProov HAPS experimental specification
    10. EchoLeak paper
    11. The Register: TrustFall and one-click RCE
    12. Research on approval fatigue and human oversight
    13. Tool-call confirmation fatigue
    14. Human-in-the-loop rubber-stamping

    Verification note: the research read public documentation and web text on September 17, 2026. It did not live-test each product. Undocumented behavior is labeled as such.

    Always-Allow Approvals · Deep DiveBuilt from live web research · 2026-09-17