An agent runs on a schedule with the process history in front of it: transcripts, tool calls, cost per step, and every edit a person made to an output. It is an ordinary automation in the workspace, a saved prompt with a trigger on it. Anyone with the right permission can read it, change it or switch it off.

No. A proposed change is replayed against the frozen benchmark first, and its effect on the score is recorded with it. Every change that ships is a version with an author, a measurement and a way to roll back. A firm can also require that a person approves any change before it lands.

From work the firm has already done. The last few months of completed packs, cleared breaks or submitted responses, with the answers people actually gave, make a graded set on day one. The suite then grows from every run a person has to correct.

That is the main failure mode, so what the loop may change is a fixed list. A standing procedure becomes a skill, and the agent is told its name instead of being handed the whole text. Anything deterministic becomes software the agent calls. Prompt size per run is one of the things the loop is measured on.

Never on its own. A run acts as a real person and every read is filtered for that person, so a process can only reach what its owner could have reached themselves. Widening that access is an administrator's action in the product, recorded against their name.

The first review cycle completes in a week and the first measured improvements land within two. The three examples on this page cover 60 runs. That is roughly where the escalation rate stops falling and the exceptions that are left are the ones that genuinely need a person.