The problem we left open
In the last post I named an operational failure that survives even after crowds and ranges exist on paper.
Vague briefs recreate Bertrand. Mark fairly is already three answers: near 1.50, near 2.10, or a diplomatic 1.80. Fused rights let one of those answers spend before a gate sees width or coverage. Research folders full of careful uncertainty objects become advisory PDFs. Advisory loses to deadline pressure.
That creates three headaches:
- A single agent session that both drafts and posts.
- A brief that never became a contract, so multiplicity returns as prose.
- An audit trail that is chat history, not a replayable decision chain.
So the question for this post is simple. If that is the failure mode, what does a real runtime solution look like?
The solution, as one stack
The core idea is older than agent demos: separation of duties plus a well-posed job. In engineering language: every capital-touching run carries a job contract; a proposer may draft; only Clearance may decide; only tool identities with a fresh Clearance token may act; tokens must bind the epistemic artifacts you already claimed were mandatory.
I turn that into five moves. Together they are one solution, not five optional add-ons. A production desk needs this stack only when money can move. Research toys can stay looser. Production cannot. The mistake is letting the toy topology become the production topology because it was already wired.
1. Replace vibes briefs with well-posed job contracts
A job record for a never-traded structure is boring on purpose: instrument id, as-of time, allowed frames, forbidden reconciliations, which outputs are requested (mark, hedge draft, both), which actions are even in scope, desk tolerances for crowd width and range overlap, and the human owner. If a field is missing, the runtime refuses to start. Mark fairly never becomes a process id.
Dual fields beat lone floats. The contract can require a spread-frame draft and a curve-frame draft as separate fields. A single anonymous float is a reject. That one mechanical rule kills a surprising amount of midpoint theater before Clearance even runs. Boring fields are how geometry becomes enforceable.
2. Split propose, decide, and act into different rights
Proposers: models, agents, optimizers. They emit drafts and artifacts. They cannot hold blotter credentials. Decide: Clearance only. It reads contract, crowd, ranges, monitors and returns allow, deny, or escalate with reasons. Act: narrow tools that check a token, execute, and log. If your architecture diagram shows one box doing all three, redraw it before you tune prompts.
This split feels slower in demos. It is faster after the first near-miss, because you stop negotiating with a fluent loop that already spent. Speed after the incident is the speed that matters.
3. Bind Clearance tokens to epistemic artifacts
An allow token is not a boolean. It carries references: contract version, feature snapshot id, near-winner set id, range objects, coverage breaker state, and expiry. Act tools verify the token signature and the hashes. If someone swaps in a new mark after allow, the token no longer matches. This is how research controls become runtime controls.
Without hash binding, Clearance becomes a polite checkbox that an agent can satisfy and then quietly replace the payload. With hash binding, the payload is part of the right. I want the right to be allergic to silent edits.
4. Make blotter tools fail closed
No token, no trade. Expired token, no trade. Token for a different instrument, no trade. Escalate decision, no trade. Deny, no trade. Soft warnings are how fused rights return. The tool API should be dull and strict. Dullness is a feature when money moves. If your blotter client can be sweet-talked by a longer prompt, it is not a blotter client. It is a chat plugin with market access.
5. Audit spine you can replay on Monday
Store the chain as data, not as chat: job contract, inputs, crowd summary, ranges, Clearance decision, token id, act receipt. A reviewer should reconstruct why 1.80 never posted, or why a hedge draft never reached the market, without interviewing the agent. If Monday needs a transcript archaeology project, the spine was theater.
A concrete walkthrough
Same morning, same never-traded structure, three attempts. Watch how the stack turns prose into either a logged escalate or a clean refusal.
Job contract requires spread draft + curve draft; forbids anonymous midpoint
Run A proposes 1.50 and 2.10 with crowd + ranges attached
Clearance: ranges disjoint, coverage breaker quiet but width high to escalate
blotter tool: no allow token to no post
Run B tries to post 1.80 from a vibes brief
admission: brief missing required fields to refuse to start
Run C sneaks a mark after an old allow
token hash mismatch to fail closed
Monday review: full chain reconstructible without chatting the model
The satisfying ending is not a cleverer prompt. It is an empty blotter with named reasons. Autonomy paused itself because the contract and the rights model demanded it. That is what I mean by a researched solution that ships: the machine stopped for a cause you can point at.
One design smell I refuse: Clearance as a library the agent may call if it feels like it. Clearance has to sit on the only road to the blotter. Optional gates become skipped gates under deadline pressure. The control plane is either mandatory or decorative.
Another smell: tokens that expire in theory but get refreshed by the same proposer process. Refresh rights belong with decide, not with draft. If the mind that proposes can mint fresh spend rights, you rebuilt fused rights with extra JSON.
On the never-traded example, the stack's job is not to pick between 1.50 and 2.10 for the agent. Its job is to make sure neither number, nor 1.80, can spend unless the contract, the crowd, and the ranges say the spend is allowed. Selection without rights is still a demo.
The flow in one breath
Well-posed job contract, then proposer drafts only, then Clearance decides with crowd and range artifacts, then a token-bound act tool fails closed without it, then a replayable audit spine. That is the systems work I care about after fused rights. Curious how others keep research fetch tools from quietly sharing credentials with spend tools.