Toward AGIAdvancedLesson 587 min read

The reference stack, with the brakes marked

Everything from both tracks in one architecture. Click any layer to see what it does and where the control point sits.

🧪 Lab · 30 min📝 Lesson test
Lesson in motion

In 60 seconds

The reference stack, with the brakes marked

Everything from both tracks in one architecture. Click any layer to see what it does and where the control point sits.

1/4
In simple words
Here is the whole machine, drawn once. The green marks are the places where a human can still say no.
This is what a serious agentic system looks like when the capability engineering from Track E meets the security engineering from Track B. Nothing here is speculative — every layer is buildable with what exists today.

Tap any box in the diagram

CAPABILITY STACK · CONTROL POINTS IN GREEN1 · Base modelpretrained, frozen weights2 · Post-trainingSFT · preferences · reasoning3 · Memoryepisodic · semantic · procedural4 · Toolsthe hands · read and write5 · Agent loopplan · act · observe · repeat6 · Orchestrationmultiple agents, long horizonsA · Sandbox + egress allow-listcontains everything aboveB · Scoped identity + secretsper agent, per user, short-livedC · Taint trackinguntrusted data cannot authoriseD · Approval gateson everything irreversibleE · Logging + replaywith the influencing sourceF · External kill switchnot a tool the system holdsevery capability on the left is matched by a control on the righta layer added without its control is a layer added without a brake
1 · The base model

Frozen weights from pretraining. It has no goals and no memory. Everything alarming in this guide is built on top of it, not inside it. Control point: which model, which version, pinned — and re-run your evaluations on every upgrade, because a model swap changes behaviour you tested.

Click any layer. Read it as a pairing: layer 3 gives the system memory and control C keeps that memory from becoming an instruction channel. Layer 4 gives it hands and control D decides which hands need a human. Adding a left-hand layer without its right-hand control is the definition of moving fast.

How to use this drawing

  1. 1

    Find your system on the left

    Most production systems today are at layers 1–4. Agentic products reach 5. A few reach 6.
  2. 2

    Check every control at or below that level

    If you are at layer 5, controls A through E should all be real, implemented things — not intentions.
  3. 3

    Before adding a layer, build its control first

    This is the whole discipline in one sentence. Ship the brake before the accelerator.
  4. 4

    Re-run Module 60's checklist

    Every time you move up a layer, the checklist has new answers. It is not a one-time exercise.
Real example
Where the two halves of this guide meet. Track E taught you to build the left column, and it is genuinely thrilling engineering. Track B taught you to build the right column, and it is mostly unglamorous. But the right column is what makes the left column something you can responsibly put in front of other people — and no amount of capability substitutes for it.

Watch and read more

Building effective agentsAnthropic engineering · readingAgent architecture patternsYouTube searchRob Miles on AI safetyRobert Miles · channel

Lab

The reference stack, drawn for a system you actually run.

~30 min

The problem

Draw the six capability layers and six controls from Module 58 for a real system. Mark each control as built, partial, or absent. Then implement the cheapest absent one.

You are done when

Hard questions

Try to answer before you reveal. If you can answer these, you understood the lesson.

Q1Your system is at layer 5 with only controls A and E. Argue for and against shipping it.Reveal
For: sandbox and logging bound the environment and give you forensics, and if permissions are narrow the realistic worst case may be acceptable — many useful systems ship exactly here. Against: without C (taint tracking) untrusted content can reach a decision, and without D (approval gates) an irreversible action can execute unattended — so your worst case is 'a poisoned input causes an unrecoverable action, and you find out from the logs afterwards'. The honest test is whether you can state that worst case out loud to whoever owns the risk. If you cannot, do not ship; if you can and they accept it, ship with a date for D.

Please sign in to continue.

Questions people ask

Do I need all of this for a small internal tool?

No. Match the controls to your layer. A layer-4 read-only assistant needs a sandbox, scoped identity and logging, and can skip most of the rest. The mistake is reaching layer 5 or 6 with layer-2 controls.

Which control gives the most protection per hour of work?

Egress allow-listing, then approval gates on irreversible actions. Between them they cut most realistic data-theft and damage paths, and neither takes long to implement.

How does this change as models get more capable?

The controls stay the same and matter more. That is the encouraging part: sandboxing, least privilege, taint tracking and an external stop are not tied to any model generation. They are the durable part of this field.

What if my organisation will not fund the right column?

Then build fewer layers on the left. That is a legitimate and often correct engineering decision, and it is far better than shipping capability you cannot control. Write down which layer you stopped at and why.

Lesson test

5 questions. Get 3 right (60%) to pass and complete this lesson.

Sign in with your phone number to take the test and save your progress