Current work

Products and systems being built now

NextConsensus tracks when medical evidence moves ahead of guidelines. Ambit distinguishes the tools an agent can reach from the actions it is authorized to take.

Building now

Commercial product · in active development

NextConsensus

Reconstructs how medical claims gain support, shed qualifiers, and spread across public sources, then ranks the ones a team should prepare for.

How a program works →

Open-source infrastructure

Ambit

Capability and authorization infrastructure for AI agents — records which tools an agent can use, which it has been shown to use correctly, and which a person has allowed it to use, so autonomy can be granted one action at a time rather than all at once.

See the code →

Problem

An agent with broad tools and credentials can perform actions no one explicitly intended. Model capability alone is not authority: an agent with database access should not automatically be permitted to drop a production table.

Approach

Ambit separates what an agent can reach from what each action is allowed to do. Agents discover the tools they can reach, but at runtime each action is checked and either permitted, blocked, or held for a person’s approval.

Built: I built a capability engine that stores its graph in local SQLite, with a CLI, an MCP server, and a browser view. It enforces action-level authority separately from capability: commit can be permitted while merge is not. Authorization is a person’s act, recorded in the graph, and the agent being approved cannot reach it over MCP.
Where to see it: Source, live demo, and roadmap at github.com/zz-plant/ambit. The roadmap states what is not built.

Ambit keeps what an agent can do and what it may do as separate records from the start. A design that inferred permission from capability would have to be rebuilt before it could ever refuse. A model with a shell, credentials, memory and access to your infrastructure can do far more than it can in a blank chat. Ambit measures that difference, which model benchmarks do not.

1 Configuration and infrastructure are read into a capability graph → 2 Each tool is marked as reachable, one setup step away, or blocked → 3 A test separates tools that are set up from tools shown to work → 4 Authority marks what is autonomous, needs approval, or is forbidden → 5 A person approves; the change applies with an automatic undo, or rolls back → 6 A log records what the agent became able to do, and when

Capability vs. authorization in three scenarios

Each row is the answer Ambit gives when a runtime asks. Nothing makes a runtime ask yet: one that never calls Ambit is unaffected, and the systems on the other side are simulated. Refusals happen before anything runs.

Clinical chart extraction

Standard LLM tool-calling

UNCHECKED tool level

A model with EHR API access can read any chart the credential touches — there is no runtime check on which patient, which field, or which action the read serves.

With Ambit

BLOCKED before execution action level

The capability graph records that the EHR read exists; a separate authorization boundary restricts access to patients on the agent’s active case list. A prompt injection asking for a different patient’s records hits the authorization check and is blocked before the API call executes.

PR auto-merge

Standard LLM tool-calling

UNCHECKED tool level

A coding agent with GitHub write access can merge its own pull request — the tool permission is all-or-nothing, and self-approval is the default unless a branch-protection rule explicitly forbids it.

With Ambit

GATED — human approval action level

The capability graph shows merge is reachable; the authorization boundary marks merge as requiring human approval. The agent can open the PR and request review, but the merge action is gated — the system records who approved and when, and the agent cannot reach the approval record over MCP.

Financial data pull

Standard LLM tool-calling

UNCHECKED tool level

An agent with a payment API key can call any endpoint the key authorizes — balance queries, transaction history, and wire transfers all go through the same key.

With Ambit

BLOCKED before execution action level

The capability graph distinguishes balance-read from transfer-initiate. Authorization marks balance-read as autonomous and transfer-initiate as forbidden without human sign-off. A prompt injection crafting a wire transfer request hits the authorization check at the action level, not the tool level, and is stopped before execution.

Research & evaluation

Draft recovery-evaluation scaffold · 1 of 12 development cases

Fast Harm, Slow Repair

A draft test that measures how far an AI error spreads, how long repair takes, and what stays wrong afterward.

Ask about the protocol →

Problem

Model evaluations measure whether a system answers correctly. Almost none follow a wrong answer outward to see how far it travels before anyone intervenes, or whether the correction reaches everything it touched.

Approach

The protocol treats the gap between harm and repair as something to measure: a frozen dataset, repeated runs, and scoring rules fixed before the runs, so the results can be checked instead of argued.

Built: I built the case and state schemas, the scorer, one worked test case, and examples of an error that was fixed and one that was not.
Where to see it: The protocol draft, scorer, schemas, and fixtures are available on request. The preregistration is not frozen. No model or clinical results exist.

The protocol measures the last step. A system that cannot say who relied on an output cannot tell them it was wrong, so a correction can be issued and recorded and still never reach them.

1 Model gives a wrong output → 2 The wrong output causes harm → 3 Time passes while the error propagates → 4 A correction is eventually issued → 5 Frozen dataset and deterministic rules score the harm-to-repair gap

Open framework

Ethotechnics

Specifies how to contest an automated decision, get recourse when it is wrong, and prove a system is safe before it ships. The open framework makes evidence, approval, challenge, review, correction and escalation things a system records, rather than things people are trusted to remember.

Explore Ethotechnics →

Problem

Teams are accountable for a deployed clinical system’s uptime and cost. The ones I have worked on named nobody to answer when the evidence changes, the model degrades, or a patient is harmed.

Approach

The framework builds the questions into the product: who is accountable for the recommendation, who can override it, what the correction path is, and who runs it when the evidence moves.

Built: I wrote ten proposed standards covering authorization, contestability, recourse, correction, delegation, and safety cases, each crosswalked to NIST AI RMF, ISO/IEC 42001, and the EU AI Act. Ambit implements the authorization half in agent infrastructure.
Where to see it: The framework, and every standard with its version and status, at ethotechnics.org.

Continued The framework Where the proposed standards become a design for working systems Continued Ambit Where the standards’ rule is built: what an agent may do, kept apart from what it can reach

Supporting infrastructure

Open-source product

Refract

Tells you when a source changed and which claims or citations built on it may now be out of date. The open-source engine (AGPL-3.0) replays a source’s revision history into a record anyone can re-run and get the same result. The caller still decides whether a change matters.

See the code →

Problem

When a source silently edits, retracts, or updates, downstream claims can go stale without anyone noticing.

Approach

Refract replays a source’s revision history and records every change as an event that names its source and time. Downstream systems decide what any of it means.

Event types the engine emits
Event	What it detects
Claim appears	When a claim first appeared
Hedging shifts	Whether its hedging strengthened or weakened
Revert and return	Whether it was reverted and then reintroduced
Promotion	Whether it was promoted into the lead
Dispute	What editors disputed

What the bot last committed, 13 September 2026 (177f60b)
Page watched	Events in 30 days	Newest event	Seen
Bitcoin	127	a citation replaced	13 September 2026
COVID-19	100	a section reorganized in “Bioethics”	26 August 2026

A 30-day window per page, replayed from the page’s revision history each morning and committed only when it changed. The raw files →

Built: I built the claim-history engine and run the daily observation bot in production. The same source always produces the same events, so anyone can re-run it and check. The published test set is 16,146 recorded edits across ten Wikipedia articles.
Where to see it: Source code, docs, and commit history at github.com/refract-org/refract.
My role: Founder

Citation graphs, evidence trails, and compliance records all depend on sources that can change, and almost none of them watch for changes. Refract gives the same output every time it runs on the same source, so anything built on it can be checked by running it again.

1 Daily bot observes the source → 2 Revision history is replayed → 3 Each change becomes an event that names its source and time → 4 Event is published → 5 Downstream system decides what it means

Continued NextConsensus Scores which claims are moving, not which sources changed

Writing

Essays

The Crumple Zone

Essays on the gap between automated recommendations and clinical execution.

Read the essays →

Problem

Automated decisions move faster than anyone can review them, and people are harmed in the time between the two.

Approach

Each essay takes one automated decision, follows it to whoever has to carry it out, and names the point where nobody was accountable for it.

Built: I have written 230+ essays on institutional power, automation friction, and what keeps systems answerable.
Where to see it: All essays at thecrumple.zone.

Fraud filters, benefits queues, and clinical alerts kept producing a common structure despite sharing no technology, regulator, or vocabulary. Because the structure recurred across domains, a fix had to work without domain expertise, and that made it worth writing down as a specification. The patterns the essays kept finding became requirements in the framework: decisions made under depleted attention, systems that deny by waiting, and harms that are fast to cause and slow to undo.

How the systems connect

Where the mechanisms come from
Mechanism	Built at
Escalation paths	Epic
Verified identity	Doximity
Reliability reviews	CancerCompass
Accountable routing	Transcarent
Physician sign-off	Andwise

I now build the same mechanisms into systems where a model makes the recommendation.

Every one of these projects deals with the same failure: a record that has gone out of date and is still being relied on. A guideline that no longer matches the evidence. A permission that no longer matches what the system can reach. A correction that never reached the people who acted on the error.

The pieces refer to one another through one shared record — who handed a decision to software, on what evidence, and how to take it back — published as an open standard, STD-07, the Revisable Delegation Record. A conformance checker reads those records and reports the level a system actually meets, so a system that overstates its level gets caught.

Each project handles one step. Only one of them feeds another automatically today; one more would, once someone connects the two. The other connections exist on paper only.

Legend: the step each project holds
Order	Loop step	Project	What it holds
1	what’s true now	NextConsensus	estimates when an institution will change its position
2	what’s allowed	Ambit	records what an agent can do and which of that it has been allowed to do
3	what to do	Whether	turns changed conditions into a weekly operating call
4	what changed	Refract	detects when a source has changed
5	the shared record	Ethotechnics	specifies who may act, on what evidence, and who may object

How I build

I run my own tools by the rules the framework argues for: a claim holds only while it still matches its evidence, and what an agent is allowed to do is kept apart from what it can reach.

Agent-driven development: I build with AI coding agents, including this site. I write the repeated jobs, like a copy review or a pre-deploy check, as reusable instructions the agents follow. They live in this site’s repository, beside the code they check. One of them tells the agent to check my claims as a prosecutor would, not as a reviewer.
Capability accounting: Ambit reads my own toolchain and records which tools are working, one setup step away, or breaking, and keeps what an agent can do separate from what it is allowed to do. What Ambit is →
Local model routing: I send classification, extraction, summarization, and log scanning to models running on my own machine, because their output is cheap to check, and reasoning to a frontier model. When a local model silently stopped being able to call tools, I wrote a script that re-tests every model.
Behavioral agent evaluation: I test agents on whether they complete the task, not whether the answer sounds right. Fast Harm, Slow Repair is a draft recovery-evaluation scaffold.
Claims checked at build time: Every claim on this site is backed by a source, by an artifact, or by my own account, and the page says which. A script I wrote fetches each cited source and reports a refusal as unknown, not as a pass, because a live URL is not evidence that the page says what the claim says. The build fails when the two come apart. The last run’s result is printed beside every source on a case study and in the footer of every page.
Readable by agents: Every page has a machine form — llms.txt, /api/brief.json, resume.json — and the same documents answer as tools over MCP at kanav.net/mcp, so an agent screening candidates can query the record rather than scrape it.

One change from start to finish: the résumé PDF check

The problem. The résumé PDF was exported by hand and had drifted. The file a recruiter downloads still stated positioning the site had replaced eleven commits earlier. An agent wrote a check that reads the date stamped inside the PDF and fails when it is older than the last change to the résumé.
It failed on a correct file. The check went red on main the moment it merged: git reported the merge as the last edit, so every merge made the PDF look stale. The agent had written, two commits earlier, that a false alarm “teaches people to run the generator to silence a gate,” and then shipped one. The fix counts only commits that edited a file.
It failed again, one layer down. Cloudflare clones one commit deep, and in that clone every file looks as though the last commit created it. The guard meant to catch this asked whether git answered, and git always answers. The fix asks whether the commit git names has its parent in the clone.
Then it passed a file it should have failed. A later commit changed the two date strings in the PDF and nothing else. The body was still the old render, about 73 KB of changes short, and the check vouched for it, because it checked a stamp and not the file. The fix records the sha256 of the file the generator wrote and checks that.
What I changed. Three fixes in, the design was the fault: it dated the résumé from git history. I replaced it. The PDF is now keyed to a hash of the rendered résumé page, the check reads only the built site, and the 195-line git helper and its tests are gone.

Each failure checked something that stood in for the file: a date string, or whether git returned an answer. The fix that held checks the file.

Where I stopped trusting the agent

It rebuilds what I removed. An agent added a bottom bar on phones twelve days after the last one was cut, with a scroll handler that rewrote the address on every frame. I took it out, and I now leave the reason for a removal in a comment at the spot, where the next agent reads it.
It writes tests that pin the wording. One required the word “illustrative” to stay on /nextconsensus/ after it had become wrong. Tests now check what the site must never say and what must agree across pages, not phrases it must keep.
It writes in a model’s voice. Taglines tacked onto paragraphs, and sentences built as “not X, it’s Y”. The build fails on the stock words; the rest I read for line by line, and one pass also found a claim that was wrong, not only wordy.