How to Turn AI into a Controlled System That Actually Works for You

When AI Acts, New Risks Appear

Large‑model AI can generate text, code, retrieve data and invoke tools, but because its output is probabilistic a single wrong answer can become a real‑world error when the model edits files, sends messages or calls APIs. Four concrete failure modes are identified:

Goal drift – the system performs many actions while gradually deviating from the intended objective.

Factual hallucination – plausible but false statements are produced.

Mis‑execution – an incorrect judgment is passed to a tool and changes reality.

Permission risk – excessive capabilities let a local error propagate to a global incident.

Examples: a mis‑interpreted file path causes an Agent to edit the wrong file; a temporary assumption treated as fact is reused throughout a long‑running task, yielding a fully coherent but entirely wrong result.

Control Theory as the Underlying Model

Norbert Wiener’s 1948 book Cybernetics introduced the idea that any system maintains its goal through information, feedback and regulation. Ross Ashby later formulated the law of requisite variety: the controller must be at least as diverse as the environment it regulates. A control loop consists of:

Target / reference value : precise, measurable objectives (e.g., keep temperature 24‑26 °C).

Controlled object : the real entities the AI changes – files, code, databases, external services.

Environment & disturbance : demand changes, noise, outdated data, hallucinations, tool failures.

Sensor : logs, test results, file diffs, API responses, user feedback.

Comparator : automatic tests, format checks, rule validators, human review.

Controller : policies, permission checks, state machines, budgeting logic.

Actuator : scripts, APIs, browsers, database writes.

Negative feedback reduces deviation; positive feedback can amplify both correct and incorrect trends. A robust AI system must limit positive feedback, especially when the Agent Loop is highly automated.

PDCA Governance and the Agent Loop

The overall control system is built from two nested loops:

Plan‑Do‑Check‑Act (PDCA) – the outer, human‑driven governance loop that defines goals, reviews outcomes, updates contracts and control structures.

Agent Loop – the inner loop that runs on a seconds‑to‑minutes scale, repeatedly sensing, acting and correcting.

Agent Loop Nine Stages

Discovery – read relevant facts, current state and constraints.

Contract – translate human intent into explicit goals, non‑goals, deliverables and risk boundaries.

Plan – choose steps, tools, checkpoints and failure handling.

Execute – perform a single bounded action with clear side‑effects.

Verify – read reality back, compare with the contract, run tests.

Repair – make targeted adjustments within budget and limits.

Human Gate – for high‑risk or ambiguous actions, present evidence and ask for approval.

Persist – store verified facts, insights and workflows for future reuse.

Schedule – when the contract is stable and verification reliable, run the loop periodically.

Harness: Runtime Skeleton Around the Model

Harness is not a longer prompt; it is a set of runtime capabilities that enforce the control loop:

Context – versioned facts, prompt‑injection prevention.

Tools – explicit input, output, side‑effects, failure semantics and idempotence.

Permissions – graded from read‑only to public publish, enforced outside the model.

State – persistent record of phase, completed items, external versions, checkpoints, budget and failure location.

Logs – concise, traceable facts (goal, sources, tool calls, changes, verification).

Verification – deterministic tests, checkers, evaluators and human review kept separate from generation.

Budget – tokens, time, tool calls, external cost, repair rounds and human attention.

Rollback – preview, backup, idempotent or compensating actions for side‑effectful tools.

Knowledge capture – route validated facts, insights, skills and test cases to knowledge bases.

Eight Design Principles

Humans own the goal; AI may clarify or decompose but cannot change the final objective without human approval.

Every task must have a contract specifying goal, non‑goal, deliverable, acceptance criteria and risk limits.

Separate generator and verifier – deterministic facts go to programs, open‑ended quality to independent evaluators, high‑risk outcomes to humans.

High‑risk actions require a human gate with evidence, impact analysis and rollback options.

Tool permissions default to the minimum needed; privilege escalation is controlled by the Harness.

All critical actions must be readable and verifiable after execution.

Failure is an expected input to the loop; the system decides when to retry, repair, degrade, roll back, hand over or stop.

Experience must be persisted after verification; validated facts enrich knowledge bases, reusable judgments become insights/skills, and failures feed test suites.

Start with a Small Closed Loop

Begin with a high‑frequency, low‑risk task that is easy to verify. Incrementally add capabilities: first establish a contract and real read‑back, then deterministic checks, then limited writes, then automated repair, then multi‑Agent scheduling. Automation should be granted only after the control loop proves observability, verifiability, stoppability and recoverability.

Concrete Example: Writing and Updating a Technical Document

Task: generate a technical article from research material and publish it to an online document.

Discovery reads the source material, the current document version and write permissions.

Contract defines the audience, core questions, structure, prohibited content and acceptance criteria.

Plan schedules material verification, drafting, structural review, fact checking and remote update.

Execute generates a local draft without overwriting the live document.

Verify runs structural checks, ensures key concepts are present and validates external references.

Repair rewrites only the parts that deviate from the contract.

Human Gate is invoked before publishing if the operation is irreversible.

Persist stores the verified facts and the workflow as a reusable skill.

Schedule can later run the loop periodically to keep the document up‑to‑date.

The same task without Harness would rely on a single model call; with Harness and the Agent Loop the system can detect errors, limit their impact and close the execution loop.

Conclusion

When AI moves from a chat‑window answerer to a real‑world actor, engineering must shift from longer prompts to a full control methodology based on classic cybernetics, PDCA, Harness and the Agent Loop. This transforms probabilistic models into reliable, observable, evolvable work systems that remain under human control.