Attention is all you need (to protect)

A comment, a summary, a notification, a request for approval. Each one asks a person to read, decide and maybe act, and each one costs something even when it's right.

The fix is attention triage. For every output, decide whether it needs a person now, later, or never, and route it there. In the reviewer, blocking findings always post. Other findings are ranked, only a few post inline, and the rest go into a collapsed section. Nitpicks never post inline, and fixes run only when the author asks for one.

Whatever does reach a person should be short. Each comment became two layers: a sentence or two written for a person, with the model's full reasoning collapsed underneath for any agent that picks up the work. The first fixes shipped within about a day and the rest over the next few weeks.

The other way AI spends attention is quieter. If you can't tell whether an agent stayed within what you asked, you check everything it did. At that point delegation saves you nothing, because you've traded doing the work for re-reading it.

What changes that is evidence you can check quickly. The work arrives with what was done, how it was validated, anything that departs from what was agreed, and what's still uncertain. Decisions that belong to you arrive as decisions, with the options, a recommendation and the evidence, while everything else the agent is allowed to do keeps moving. Your attention goes to judgment instead of reconstruction.

In my research systems, an agent that wants to report there's nothing for a person to decide has to list the questions it considered and say why each one isn't theirs. That list is what gets confirmed, so the person checks specific reasoning instead of waving through a paragraph. Give agents a contract goes into how that works.

Trust that actually saves attention can't come from a good prompt or a good model alone. It comes from structure around the model, checked while the work happens. Start with intent written down somewhere the agent can't rewrite.

Then check each handoff against it: the plan against the original request, the implementation against the plan with no unexpected additions, and the docs against the implementation. Agents wrote the reviewer's code, checks like these ran at every handoff, and I read the sensitive parts myself.

Enforce limits outside the prompt. The reviewer's agents held no credentials. They read what the pipeline gave them and wrote results back, and the pipeline did the posting. Opening a PR, merging it and rolling it out are separate permissions, and handing work to another agent shouldn't widen them. Stop telling agents what not to do has more on this.

And put required steps in code. The reviewer's orchestrating model was told to dispatch its specialist reviewers before posting. In a seeded trial, all five runs posted a review that looked fine, and two of them had skipped dispatch and written the review themselves. Dispatch moved into code, the model kept the judgment calls, and the orchestrator went from about 80 percent of a review's cost to about a quarter.

Trust in the measurements matters as much as trust in the agent. In one of the reviewer's evals, a case looked flaky, so I read all 28 runs.

The reviewer had found the defect every time. The scorer only accepted one source location. Fixing the scorer changed the numbers without changing the reviewer. A broken scorer looks just like a weak model, and an evaluator you just changed can't be the only evidence that its change helped.

Monitors need the same treatment. One of the first monitors in my research systems ran a model over everything it saw and produced a stream of false alarms that people learned to ignore. Once people learn to ignore a monitor, they ignore the real alarm too. Measure the system, not just the model covers how to test the watchers.