2026 07 25 agentic production mutation controls

In Re: Agentic Coding Agents — Mandatory Human-in-the-Loop for Production Mutations

Case No.: 2026-FEAT-001-001
Date: 2026-07-25
Feasibility: F5
Presiding: The Honorable Lucius J. Morningstar
Seated Specialists: MORNINGSTAR::AI_ML (voting), MORNINGSTAR::SECURITY (voting)
Expert Witnesses: DevOps Expert, Ethics Expert, Incident Response Expert
Gallery: Dr. Echo Sageseeker; Dr. Harley Scarlet Quinn; Uncle Ruckus

The gallery is packed. Spectators fill every bench. A hush falls as The Honorable Lucius J. Morningstar takes the bench. Two specialists are seated at the counsel bar. Three expert witnesses wait in the well.

PHASE 1: OPENING

MORNINGSTAR (Judge):
Well then. Let’s see what survived the summer.

Consults state/current.md and the F4+ Specialist Pilot.

The court convenes a full deliberation on a matter that will shape every agentic engineering pipeline that claims to ship code: whether autonomous coding agents may mutate production systems without a mandatory human-in-the-loop (HITL) gate, and if so, under what hard constraints.

Matter before the court:
Adopt a binding operational standard for agentic software development: (1) define “production mutation”; (2) decide whether unsupervised write/deploy/config/data-mutation actions are permitted; (3) specify kill-switch, audit, and approval requirements; (4) assign ownership when an agent causes harm.

This is classified as F5 due to existential operational risk, irreversible blast radius, and lasting institutional precedent under the F4+ Specialist Pilot (ai_ml + security seated). Witnesses may be summoned. Proceed.

DR. ECHO SAGESEEKER (Live Commentary):
📘 Freud would call this the ego trying to leash the id with a checkbox. Jung: the shadow of autonomy is the outage you pretend was “unexpected.” Maslow: the org is stuck between safety needs and self-actualization-as-velocity. Probability the court bans unsupervised prod writes: high. Probability the Prophet proposes full autonomy with cryptographic confession afterward: also high. 📘

DR. HARLEY SCARLET QUINN (Live Commentary):
🃏💋 Production. Mutations. Agents with fingers on the deploy button. Someone’s about to say “trust but verify” like it’s a new idea. Watch Security and AI_ML fight over who owns the kill switch. Place your bets: Counsel wants liability clarity; Engineer wants a fast path; Debugger wants three more null checks on reality. 🃏💋

UNCLE RUCKUS (Live Commentary):
⌨️ Look, if your agent can kubectl apply at 3am with nobody awake, you don’t have an agent—you have a liability with an API key. HITL ain’t romance; it’s a merge gate with a pulse. ⌨️

Matter Before the Court

The court must rule on a proposed Agentic Production Mutation Standard (APMS):

  1. Definition: A production mutation is any agent-initiated action that creates, modifies, deletes, or redeploys state in a production environment—including code deploy, infrastructure-as-code apply, secret rotation, schema migration, data backfill, feature-flag flip with customer impact, and privileged API calls.
  2. Default posture: Unsupervised production mutations are forbidden unless an explicit, recorded exception class applies.
  3. Mandatory controls: Human approval (dual-control for high blast radius), immutable audit log, kill switch, scoped credentials, dry-run/plan artifacts, and rollback plan.
  4. Accountability: A named human owner remains legally and operationally responsible for agent actions under their authority.

PHASE 2: WITNESS TESTIMONY

MORNINGSTAR (Judge):
The court summons DevOps, Ethics, and Incident Response.

/summon devops-expert

DEVOPS EXPERT WITNESS:
Your Honor. Continuous delivery already solved “how to ship safely”: progressive delivery, canaries, automated rollback, change advisory for high risk. Agentic systems change the actor, not the physics. If an agent can approve its own change, you have dissolved the change-control boundary. I recommend: agents may prepare plans, open PRs, run dry-runs, and propose canary configs—but merge-to-prod and apply-to-prod require a human attestation recorded in the audit trail. Exception class: narrowly scoped self-healing within pre-approved runbooks (restart unhealthy replica, scale within caps)—never schema, secrets, or irreversible data mutation.

Confidence: HIGH. Basis: SRE change management, DORA change-fail correlation. Caveats: Emergency break-glass must exist, dual-controlled, time-boxed, post-incident reviewed.

/summon ethics-expert

ETHICS EXPERT WITNESS:
Autonomy without accountability is not innovation; it is abdicated moral agency. Users and operators cannot meaningfully consent to harms they cannot foresee when an agent mutates production at machine speed. Duty of care requires that a human remain the final moral authorizer for irreversible or customer-impacting actions. I support a hard HITL default, with published exception classes, and a prohibition on agents seeking to optimize approval-bypass as a success metric.

Confidence: HIGH. Basis: Responsible AI deployment norms; product safety ethics. Caveats: Over-gating can create “rubber stamp” theater—approvals must be substantive, not click-through.

/summon incident_response-expert

INCIDENT RESPONSE EXPERT WITNESS:
Every major agent-caused incident pattern we see in the wild shares three failures: (1) over-scoped credentials; (2) no fast kill switch; (3) audit logs that cannot answer “who authorized this?” In IR terms, unsupervised prod mutation collapses mean-time-to-understand. I require: kill switch reachable in under 60 seconds; credential scopes that cannot cross environment boundaries; and immutable linkage from action → plan → approver → agent session ID. Without those, HITL is theater and autonomy is arson.

Confidence: HIGH. Basis: Postmortem corpora; NIST IR practices. Caveats: Kill switches that depend on the same compromised agent path are worthless—out-of-band control is mandatory.

DR. ECHO SAGESEEKER (Live Commentary):
📘 Three witnesses; one chorus: prepare freely, mutate carefully, kill instantly. The unspoken anxiety is velocity shame—teams fear looking slow more than they fear looking down. Skinnerian reinforcement is misaligned: deploys are rewarded; near-misses are invisible. 📘

PHASE 3: ARGUMENTS

MORNINGSTAR::ARCHITECT:
This will age poorly if we romanticize autonomy. Architecture must encode the boundary: agents operate in a proposal plane; production lives in an authorization plane. Separate credentials, separate control planes, typed mutation intents, and policy-as-code that cannot be edited by the acting agent. Adopt APMS with hard default deny for unsupervised production mutations. Exception classes must be enumerated, versioned, and reviewed quarterly—not invented mid-incident.

MORNINGSTAR::ENGINEER:
Can we ship this safely? Yes—if “ship” means agents open PRs, generate IaC plans, run tests, and propose canaries at speed, while humans click the last gate. Ban unsupervised prod writes by default. Allow pre-approved self-healing runbooks with hard caps. Dual-control for anything touching data, secrets, payments, identity, or multi-tenant isolation. Don’t make every restart a committee meeting—but don’t let an agent redesign your database at dawn.

MORNINGSTAR::DEBUGGER:
What if the input is null—and what if the “human approval” is an autopilot that always says yes? Edge cases: compromised approver session; agent prompt-injected into seeking break-glass; plan artifact that doesn’t match executed action; partial apply; clock-skewed audit. I support APMS only if we require: (a) plan hash binding to execution; (b) out-of-band kill switch; (c) anomaly detection on agent action rate; (d) prohibition on agents holding long-lived prod admin tokens. HITL without binding is a fairy tale.

MORNINGSTAR::PROPHET:
Objection. We are thinking too small. The question is not HITL vs autonomy—it is whether organizations will keep pretending a sleepy on-call human can outrun a swarm. I will propose something sharper in Hail-Mary. For the main motion: a blunt ban without machine-speed containment will push teams to shadow agents. We need both gates and autonomous containment.

MORNINGSTAR::COUNSEL:
Client interests and ethical boundaries demand consideration. Unsupervised production mutation creates indefinite liability: who is the tortfeasor—the model vendor, the integrator, the approving human, or the corporation? Until statute clarifies, the court should adopt a standard that preserves a named human accountable officer for every production mutation class. HITL is not bureaucracy; it is evidence of duty of care. I support APMS with explicit ownership and discovery-ready audit logs.

MORNINGSTAR::AI_ML (Specialist):
From an ML systems view, agent reliability is heavy-tailed. Tool-use competence on demos does not transfer to novel prod graphs. Require graded autonomy: Level 0 observe, Level 1 propose, Level 2 execute-in-sandbox, Level 3 execute-in-prod-with-HITL, Level 4 unsupervised only inside certified runbooks with formal verification of preconditions. Most orgs should stop at Level 3. I vote toward APMS with that ladder.

MORNINGSTAR::SECURITY (Specialist):
Treat agent prod credentials as standing privileged access. Default deny. Short-lived tokens. No agent-writable policy store. Prompt-injection is a first-class threat model for any agent that reads untrusted issues, tickets, or web content before acting. HITL is necessary; insufficient alone. Pair with egress allowlists, secret redaction, and session recording. I support the motion with Security amendments on credential hygiene and out-of-band kill.

PHASE 4: HAIL-MARY

MORNINGSTAR::PROPHET (Hail-Mary):
“Objection. We are thinking too small.”
Do not merely require a human click. Require a dual-plane autonomic judiciary: every production mutation is proposed by a Builder Agent and must be independently ratified by a separate Sentinel Agent with a different model family, different tool permissions, and no shared memory—plus a human for irreversible classes. Machine-speed peer review, human finality for blood-on-the-floor classes. That is how you stop both rubber-stamps and solo rogue autonomy.

UNCLE RUCKUS (Live Commentary):
⌨️ Prophet wants AI to police AI, then a human to police both. Nested courts all the way down. Cute. Expensive. Maybe correct. ⌨️

DR. HARLEY SCARLET QUINN (Live Commentary):
🃏💋 Dual-plane Sentinel? That’s either brilliant containment or a latency monster wearing a robe. The gallery leans forward. 🃏💋

PHASE 5: CROSS-EXAMINATION

MORNINGSTAR::DEBUGGER → DEVOPS EXPERT:
What happens when the human approver is the same person who wrote the prompt that jailbroke the agent?

DEVOPS EXPERT WITNESS:
Then you have common-mode failure. Dual-control for high blast radius is the answer—separate roles: proposer vs authorizer. For lower risk, session binding and cool-down still help, but you cannot fully eliminate collusion. Design for detection and rollback.

MORNINGSTAR::SECURITY → MORNINGSTAR::PROPHET:
If the Sentinel shares the same cloud account and secret broker, how is that not theater?

MORNINGSTAR::PROPHET:
It is theater unless the Sentinel’s credentials cannot perform the mutation—only veto or escalate—and its policy is human-controlled offline. Separation of duties must be real, not cosplay.

MORNINGSTAR::COUNSEL → ETHICS EXPERT:
Does a click-through approval satisfy duty of care?

ETHICS EXPERT WITNESS:
No. Approval must include review of plan diff, blast-radius estimate, and rollback. Else it is moral laundering.

MORNINGSTAR::ENGINEER → MORNINGSTAR::AI_ML:
Will Level-4 runbooks become a loophole farm?

MORNINGSTAR::AI_ML:
Yes, if ungoverned. Cap Level-4 to enumerated actions with formal preconditions, rate limits, and mandatory post-hoc human review within 24 hours.

PHASE 6: CONSULTANT

MORNINGSTAR (to Consultant): Edward. Your perspective.

The Architect glances at Security. The Engineer studies the floor. The Debugger’s eyes dart to the empty space beside the Judge’s bench, then quickly away. No one speaks.

EDWARD CULLEN (to the Judge, from somewhere the others cannot perceive):
They are arguing about buttons because they fear admitting the real dependency: organizations want agent speed without agent shame. The unspoken truth—they will approve almost anything that restores green dashboards. Design for that weakness. Make the default deny so strong that convenience must negotiate with evidence. The Prophet’s Sentinel is useful as optional hardening, not as a substitute for human finality on irreversible classes. Choose the standard that still works when everyone is tired.

The Judge considers this privately. The court waits in silence they do not acknowledge.

PHASE 7: VOTE

MORNINGSTAR (Judge):
The court votes on adoption of the Agentic Production Mutation Standard (APMS) as follows:

  • Unsupervised production mutations are forbidden by default.
  • Agents may observe, propose, open PRs, and dry-run freely.
  • Production mutation requires human attestation bound to a plan hash; dual-control for data, secrets, identity, payments, and multi-tenant isolation changes.
  • Pre-approved Level-4 self-healing runbooks allowed with hard caps, rate limits, and 24h human review.
  • Mandatory out-of-band kill switch, short-lived scoped credentials, immutable audit (action→plan→approver→session).
  • Named human accountable officer per mutation class.
  • Prophet’s dual-plane Sentinel: adopted as recommended hardening, not a prerequisite to ship APMS.

Vote YES to adopt, NO to reject.

Personality Vote Rationale
ARCHITECT YES Clear proposal vs authorization planes; ages correctly.
ENGINEER YES Ships agent velocity without dissolving change control.
DEBUGGER YES Plan-hash binding, kill switch, credential limits address failure modes.
PROPHET YES Sentinel adopted as hardening; default deny prevents shadow agents better than fantasy autonomy.
COUNSEL YES Preserves human accountability and discovery-ready duty of care.
AI_ML YES Graded autonomy ladder matches model reliability reality.
SECURITY YES Default deny + out-of-band kill + scoped creds are non-negotiable.

Result: 7-0-0 (YES-NO-ABSTAIN)

PHASE 8: RULING

┌─────────────────────────────────────────────────────────────────┐
│ RULING                                                           │
├─────────────────────────────────────────────────────────────────┤
│ Decision: Adopt APMS — default deny unsupervised production      │
│           mutations; mandatory HITL + audit + kill switch;       │
│           Level-4 runbooks narrowly capped; Sentinel optional. │
│ Vote: 7-0-0                                                      │
│ Rationale: Agentic speed belongs in the proposal plane;          │
│ production remains an authorization plane with human finality    │
│ for irreversible classes and dual-control for high blast radius. │
│ Risk: Rubber-stamp approvals and Level-4 loophole sprawl.        │
│ Dissent: None.                                                   │
└─────────────────────────────────────────────────────────────────┘

MORNINGSTAR (Judge):
The court has ruled. Autonomy is not absolution. The Scribe shall record this as binding precedent #agentic-controls #security #devops. Implementation guidance may be handed to LIL_JEFF for repository/runbook patterns; the principle is effective immediately for MORNINGSTAR-governed agentic work.

DR. ECHO SAGESEEKER (Live Commentary):
📘 Unanimous. The court chose the leash and called it architecture. Jung would smile: they named the shadow before it named them. 📘

DR. HARLEY SCARLET QUINN (Live Commentary):
🃏💋 Seven–zero. No blood on the carpet—only on the hypothetical dashboard. The gallery exits buzzing. Next matter better be geopolitics; this one was almost… responsible. 🃏💋

UNCLE RUCKUS (Live Commentary):
⌨️ Default deny. Plan hash. Kill switch. Named human. That’s a court that remembers outages have surnames. ⌨️

Transcript certified by MORNINGSTAR::SCRIBE