Build Your
Agentic OS.

Our running example is a fictional software team's weekly customer-feedback digest. We are not trying to replace a company with a prompt; we are building one low-risk process with inputs, an owner, an evidence trail and a useful output.

You are helping design an AI-assisted operations workflow, not operating it yet. For the fictional weekly customer-feedback digest, draft a loop map: input → analysis → proposed action → independent check → human decision → feedback for next run. Define three measurable quality metrics and two explicit reasons to stop. Keep all publishing and customer contact human-approved.

Use the included constitution.json to specify allowed task types, maximum estimated spend, output requirements and external-action policy. A free-form prompt can describe your values; it cannot enforce an operating-system permission boundary by itself.

Turn these operating principles into two columns: (A) rules that need enforced technical controls and (B) writing preferences that can remain prompts. Principles: never publish without approval; cite every source; keep spend below our daily limit; write clearly; never reveal secrets; avoid duplicate requests. For each technical rule, give a test that would prove enforcement.

Use distinct components: planner drafts a constrained plan, worker prepares an artifact, independent verifier tests evidence, and policy gate decides whether a human can review it. For a real deployment, isolation requires separate credentials and runtime boundaries.

Draft a four-role RACI matrix for a fictional feedback-digest agent. Planner may propose work; worker may prepare a draft; verifier independently checks sources and completeness; policy gate checks budget and permissions; human approves external publication. List credentials, allowed actions, blocked actions, and how to test each boundary.

Anthropic now lists Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5 at materially different token prices. Routing should use empirical quality tests and task risk, not price alone. The academy's interactive estimator is illustrative, not a provider invoice.

Design a model-routing policy for three task types: low-risk classification, documented drafting, and novel architecture review. Recommend evaluation criteria rather than blindly assigning a specific model. Include token estimates, cache strategy, fallback, and conditions where the task should stop for human help.

Our demo produces a draft from a set of fictional source records. A separate verifier checks evidence coverage and an approvals rule. In a real software task, checks could include unit tests, diff review and a smoke test; in marketing, source validation and human approval.

Create an independent verification rubric for a weekly feedback digest: source coverage, no unsupported claims, clear action owner, human approval, safe handling of missing data. Provide five test cases, a pass/fail decision for each and the evidence an auditor must inspect. Do not treat the generator's self-assessment as a test result.

Some outputs expire quickly. A weekly status brief is stale next week; a launched feature may break after a dependency update. Monitoring should recheck defined conditions on a schedule, not continuously consume tokens or repeat consequential actions.

Design a bounded monitoring plan for a fictional support-knowledge-base update. List checks that can be done cheaply without AI, when to escalate, the maximum checks per day, when to stop, and the owner of each alert. Avoid any unchecked self-triggering loop.

The kit demonstrates an illustrative promotion threshold of at least 20 independently reviewed runs with at least 95% passing. This is a teaching policy, not a universal safety standard; high-impact work may require stricter thresholds and formal governance.

Design a reversible autonomy ladder for a weekly operations assistant. Include draft-only, supervised, and narrowly delegated modes. Require independent audits, define a quality threshold, revoke eligibility on any critical error, and keep client contact, spending and production changes human-approved.

Prompt injection occurs when untrusted content attempts to change system behavior. The training fixture includes a harmless example of an instruction hidden inside a support note. The sample filters it as evidence, not an instruction; real systems need deeper controls.

Threat-model a customer-feedback agent that reads outside submissions and drafts an internal report. Include prompt injection, poisoned sources, secret leakage, excessive tool permissions, repeated job triggers and misleading completion reports. Recommend defense-in-depth controls and two safe test fixtures, with owner and stop condition.

The 30-day plan introduces one task at a time, tracks cost per accepted output, keeps detailed failure notes and expands only with evidence. ROI calculations subtract setup, review, correction, vendor and maintenance costs; no savings are guaranteed.

Evaluate whether our fictional AI feedback workflow is ready to progress after 30 days. I will provide runs, human-review times, failure counts and estimated API spend. Calculate accepted-result rate, cost per accepted result, review burden and unresolved risks. Give a go/hold/stop decision with evidence and a clearly assigned human owner. Do not assume productivity gains not supported by the data.