The rules I build to, applied to my own systems first

01 Outside the AI's reach

The controls that matter sit around the AI, where no prompt can reach them

An AI follows the words in front of it, including words someone planted in an email or a file. So the AI never holds the final say. The checks around it do, and they answer to a person.

• Gates on what cannot be undoneOutgoing mail waits behind a gate the AI cannot open, and a person sends it. Money never moves on an AI's word. A change to a gate takes effect only after I approve it.
• A record it cannot quietly rewriteEach outcome goes into a chained record. Every line carries a fingerprint of the line before it, so an edit after the fact breaks the chain, and the check reports the break.
• Done means checkedA task reads as done only when a separate check re-reads the proof. The AI's own word never closes a task, and a status the check cannot back drops to unproven on its own.

02 Your request

Where your request goes when you send it

The Blueprint form on this site runs under the same rules. This is everything it does with what you type.

• What is keptWhat you type into the form, the page address, and the tag in the link you came by. Nothing else goes into the database.
• Where it livesOne private database in western North America. I am the only person who reads it.
• What reaches my phoneA short notice with your company name and your headline answers. Never your name, your email or your phone number.
• What is never kept with itYour IP address and your device details. To stop floods of automated requests, a scrambled form of the address is held for a few minutes, apart from your request.

No cookies of my own, no ad trackers, no mailing list. The policies page names every outside service involved.

03 In writing

What you can read before any work starts

Each one by name, so your partner, your lender or your lawyer can ask for it.

• The service agreementScope, timeline, investment and payment schedule, in plain English. Nothing is charged before you approve it.
• Exhibit A: the BlueprintThe one-page plan, attached to the agreement as the scope of the work.
• Exhibit B: data, tools and autonomyEvery outside tool that can see your data, each one approved by you in writing, and how much each part may do without a person. Every part that sends anything starts at drafts only.
• An agent card for every agentPurpose, tools, data, what it may do alone, what it may never do, and its off switch.
• The launch checklist and the inspection recordDated, and kept with your Blueprint.
• A mutual non-disclosure agreementBefore you share anything private, if you want one first.
• Your accounts, your access listYou own your data, your accounts and everything the system produces for you. You can see and remove my access at any time, and passwords and keys stay in your own accounts.
• Return and deletion, in writingWhen our work ends, your data comes back to you or is deleted, except what the law requires me to keep, and I confirm it in writing.

04 Measured

Measured, with dates

Your build is scored on a 0 to 3 scale, rule by rule, and you read the score before you approve anything. A 1 is a rule in words. A 2 is a check that catches a slip. A 3 means the slip is impossible by construction. Only 3s count as finished.

When one of my own systems fails quietly, the case goes into the field guide with its date and the check that now catches it.

05 The weekly report

What you read every week, in plain English

Every build sends the owner one short report a week: what the system did on its own, what it held for a person, and what failed. This sample is drawn for an invented property management office.

• Did on its ownAnswered 41 routine tenant emails from your policies, the kinds you approved. Closed 12 work orders, each with the vendor's photos.
• Held for a person6 replies outside your policies, drafted and waiting for a manager. 1 vendor not on your approved list.
• Failed, and said so2 scanned insurance certificates it could not read. It flagged both to a person instead of filing them as complete.
• Changed what it may do aloneNothing. That takes your approval.
• Off switches usedNone this week.

Sample · invented company · illustration only

06 Beside your security tools

Keep your security tools. This work sits beside them.

Your security tools and your IT provider watch for attackers coming in. The eight rules govern what your own AI may do with the access you gave it. You want both, and neither replaces the other.