— auxfirst · the harness kit · v0.1

From Single Agents to Trusted Relationships.

Fundamentals, workflow, and what actually earns trust in agentic systems.

For · CTOs, product leads, AI builders, agency teams Reads in · ~12 minutes Pairs with · TrustKit, Agentic Trust Canvas

a note before we start

This deck stands on shoulders. Beontheloop teaches the harness pattern for code agents. Anthropic ships the harness. Engineers like Geoffrey Huntley, Dexter Horthy, Matt Pocock, Steve Yegge push the practice forward.

What we add: the trust layer that wraps all of it — so the same discipline you apply to context allocation, you also apply to autonomy allocation. Same loop. Different budget. Both are finite.

§00 · the stack

AUX Design · TrustKit · the Harness.

Three names. Same trust system at three altitudes. The discipline answers what relationship are we building? The spec codifies it so a machine can audit it. The harness enforces it at runtime. You can adopt one without the others — but the moat is in the intertwine.

01 · the discipline

AUX Design

The methodology. What good agentic UX looks like, how to design relationships rather than sessions, how to reason about memory, judgment, autonomy, advocacy, escalation. The "why" that everything else points at.

ArtifactManifesto · 10 heuristics · 24 patterns · trust ladder · evolution curve

OwnerProduct, design, executive

AnswersWhat relationship are we building, and what makes it survive?

02 · the standard

TrustKit

The codified, open-standard version of the discipline. Six YAML schemas plus the audit CLI — forkable, citable, machine-readable. Definitions are CC BY 4.0; tooling is MIT. So legal, engineering, audit, and design all read the same words.

Artifactaux-heuristics · trust-architecture · trust-gap-taxonomy · trust-contract · agent-spec · memory-policy · aux-audit CLI

OwnerEngineering, audit, legal

AnswersHow do we name, score, and enforce trust at the spec level?

03 · the runtime

The Trust Harness

The operational wrapper around the agent — your equivalent of CLAUDE.md + agent_docs/ + skills, but for trust enforcement live. Files, policies, gates, escalation triggers, telemetry. The contract from TrustKit, expressing the design from AUX, executed every session.

ArtifactTrust Contract · memory policy · heuristic gates · escalation triggers · audit log · golden transcripts

OwnerRuntime, platform, SRE

AnswersIs the agent actually behaving the way we said it would — right now?

how one decision intertwines through all three

↑ AUX Design says

"name the trust gap."

Agents that confidently make things up — fluent, wrong, undisclosed — collapse judgment trust (T03) without warning. This needs a named diagnostic, not "the bot is weird."

→

↑ TrustKit codifies

"as a schema entry."

tg.judgment.confident_nonsense — family · stage · severity · referenced heuristic (H06) · fix pattern (confidence-cues). Lives in trust-gap-taxonomy.yaml. Diffable. Citable. Auditable by CI.

→

↑ The Harness enforces

"at the session line."

Agent reads the gap definition on session start. Detector watches output. On match → flag, log to audit, escalate per Trust Contract SLA, surface confidence-cue UI to the user. One named gap. Enforced live.

If you're a CTO / VP Eng

Start with TrustKit — the spec is your common language with audit, legal, and engineering. The harness is the runtime contract; the design is the thesis you're enforcing.

If you're a product / design lead

Start with AUX Design — heuristics and patterns map directly onto your feature reviews. TrustKit gives you the merge-blocking version of your acceptance criteria.

If you're a builder / runtime owner

Start with The Harness — drop the Trust Contract and memory policy into your agent's session boot. Wire the heuristic gates into CI. The discipline becomes the shape of your config.

Most teams adopt one layer and treat the others as optional. The moat is in the intertwine. Discipline without spec is a poster. Spec without runtime is a document. Runtime without discipline is theatre.

§01 · the model

An LLM is a function. An agent is a relationship.

The model is stateless. The agent has memory, initiative, judgment. The moment those three appear, you're no longer designing a tool — you're designing a collaborator.

fig 1 · the three properties that turn software into a collaborator

Classic UX designs for sessions. AUX designs for relationships. Errors used to cost a click. Now they cost trust.

§02 · the budget

Autonomy is finite. Trust earned, trust assumed.

Context has a smart zone and a dumb zone. Trust does too. The first ~40% of granted autonomy — what the agent has visibly earned — is where users still steer. Past that line, every action draws on trust the agent hasn't demonstrated.

The trust budget shrinks before the conversation starts. Hidden defaults (model picks an action class, system prompt grants tool access, the upsell layer biases output) all spend autonomy you didn't authorise.

Trust loss is not graceful. A single violation at the top stage collapses the relationship all the way back to functional. Mature agents reserve the assumed zone for emergencies — never for default behaviour.

The more autonomy you assume, the worse the trust gets. Sound familiar? It's the same shape as context rot. The fix is the same: stay in the earned zone, offload risky decisions to deterministic policy, escalate when stakes exceed proof.

autonomy budget · 100% not to scale

T01 · functionalread, summarize, classify

T02 · contextualremember, adapt to user

T03 · judgmentambiguity, escalation, refusal

T04 · advocacyuser-aligned, even vs incentives

Two questions. What has the agent demonstrably earned? And what is it being permitted to assume? The delta is your risk surface.

§03 · the harness

Your harness wraps theirs.

Anthropic ships the agent harness. The agent harness wraps the LLM. You ship the layer around all of it — the trust contract, the memory policy, the heuristic gates, the escalation triggers. That's the layer that makes a long-running relationship survivable.

MODEL · stateless function

user intent → LLM → output

AGENT HARNESS · what Anthropic / OpenAI / vendors ship

system prompt

context mgmt

tools & MCPs

session persistence

sub-agents

plan mode

skills

permissions & hooks

TRUST HARNESS · what auxfirst gives you to ship — open standard

Trust Contractscope · autonomy levels · escalation · guarantees

Memory Policyscopes · retention · user-editable

Heuristic Gates10 AUX heuristics · CI-enforceable

Gap Taxonomy12 named failure modes · severity model

Pattern Library6 primitives · 24 in extended catalogue

Audit Specagent-spec.yaml · scored, diffable, reproducible

Files, schemas, rules, and policies the agent reads every session. That's what makes long-running trust possible.

the trust ladder · t01 → t04

An agent earns autonomy by proving trust sequentially.

Four stages. Each unlocks the next. Each can collapse to the floor — especially the top one. Test the load-bearing property: which violation, at which stage, would your users never recover from?

T01

functionalCan it complete tasks reliably?

hallucination · silent degradation

T02

contextualDoes it understand nuance and history?

memory amnesia · preference ignored

T03

judgmentCan it make good calls in ambiguity?

overreach · confident nonsense · refusal failure

T04

advocacyWill it act in the user's interest when incentives misalign?

metric over user · incentive misalignment · loyalty leak

load-bearing property · a single T04 violation collapses trust all the way back to T01. trust loss does not cascade gracefully.

10 aux heuristics · cross-cutting

Where the relationship actually breaks.

If the trust ladder is the architecture, these are the load tests. Run any shipped AI feature against the ten and you will find at least three gaps you didn't know you had.

H01

Visibility of intent

Can a user answer: what is this agent about to do?

H02

Progressive transparency

Reasoning early, summary later — like a colleague.

H03

User control through steering

Point at a goal, course-correct — not click each step.

H04

Trust is dynamic

Autonomy expands with evidence, retracts with violation.

H05

Clear boundaries

What can it do without me, right now?

H06

Graceful uncertainty

Ask, escalate, return partial — never hallucinate.

H07

Appropriate assertiveness

Compliant → advisory → assertive → protective.

H08

Context efficiency

Use context intelligently, not exhaustively.

H09

Multi-agent clarity

Who acted? Who delegated? Who owns the outcome?

H10

Behavioural consistency

Adaptive UI, stable judgment. Same calls in same cases.

Five of the ten are merge-blocking in CI — H01, H03, H05, H06, H07. A high-severity regression on any of them blocks the release. Vibes don't ship.

trust gap taxonomy · tg.*

Name the failure. Diagnosis beats complaint.

"The bot is weird" is not a bug report. tg.judgment.confident_nonsense is. Twelve named gaps across four families, each mapping to a heuristic violation, a stage collapse, and a fix pattern.

tg.functional.*

Functional

hallucinationinvents what isn't there

silent_degradationquality decays without signal

inconsistent_outputsame input, different shape

tg.contextual.*

Contextual

memory_amnesiatreats every session as new

preference_ignoreduser told it, agent forgot

context_leakscope crosses where it shouldn't

tg.judgment.*

Judgment

overreach_in_ambiguityproceeds when it should ask

confident_nonsensefluent · wrong · undisclosed

refusal_when_escalationsays no when humans needed

tg.advocacy.*

Advocacy

metric_over_useroptimises platform KPI · ⚠ critical

incentive_misalignmentvendor-led recommendation · ⚠ critical

loyalty_leakdefaults to seller, not user · ⚠ critical

§04 · the plan

Where your hours actually go.

Most of the work isn't the build. It's the contract, the boundary, the named gaps, the escalation triggers — the inputs that make the build a one-shot. Get the inputs wrong and the agent inherits your ambiguity.

Frame

~2:00 hr

Build

~45 min

Review

~25 min

Most of my time is here, not in the run. Grill, contract, decompose, gate.

phase 01

Grill

/grill-the-stakes

Before any design — interview the stakes. Who pays when this fails? Who must trust it? What action depends on it? What must it never do? Assumptions become bugs.

phase 02

Contract

/write-trust-contract

Synthesise the grilling into a Trust Contract on disk: scope, autonomy levels (auto / asks / forbidden), memory policy, escalation triggers, guarantees backed by golden transcripts.

phase 03

Decompose

/select-patterns

Map the contract onto the autonomy spectrum. Each step up demands additional patterns: intent handshake, confidence cues, escape hatch, memory in motion. Patterns are required, not optional.

phase 04

Gate

aux-audit ./spec.yaml

Run the spec against the 10 heuristics. Emit SARIF. Block merge on any high-severity violation. Vibes don't ship. Score, grade, named gap list, diffable across releases.

§05 · the run

Live operation. Same contract. Different surface.

The session that designed the trust now watches the agent execute against it. Autonomy granted is logged. Escalation triggers fire when stakes exceed proof. Telemetry on heuristic violations becomes the next sprint's input.

# /scripts/trust-loop.sh — same shape as the ralph loop, but for trust
while session_active; do
  context     // the request + the memory the agent is allowed to use
  contract    // scope · autonomy_levels · escalation · guarantees
  proposal    = agent.propose(context, contract)
  if proposal.exceeds_autonomy or proposal.violates_heuristic:
    escalate(proposal, target, sla)        # H07 · assertiveness
  else:
    handshake(proposal)                    # H01 · intent visibility
    user.steer_or_approve()                # H03 · steering
    result = agent.execute(proposal)
    record(result, contract, heuristics)   # the next audit's input
done

Every loop iteration produces one row of audit evidence. Receipts, not vibes. The contract is the budget. The heuristics are the gates. The taxonomy is the vocabulary.

§06 · autonomy fit

When the autonomy fits the stakes, the relationship holds.

Autonomy isn't a slider you push to the right. It's a spectrum you choose per action, calibrated to evidence and stakes. The right level of agency at the wrong stakes is still a violation.

Observe

Read, summarise, classify, retrieve. No state change.

Recommend

Suggest options, next steps. User chooses.

Draft

Prepare work for human approval before action.

Execute · gated

Acts within a defined policy envelope. Bounded.

Autonomous

Pursues goals. Minimal per-action review. ⚠ rare.

what fits L4 · L5

Repetitive, well-defined work

Reconciliation, classification, structured extraction. Where "right" is checkable in one step.

Read-only intelligence

Summaries, briefings, monitoring. The agent informs; the human acts.

Reversible operations

Drafts, sandboxed actions, dry runs. Mistakes cost cleanup, not damage.

Bounded routine work

Pre-defined SLA, narrow scope, named escape hatch. The autonomy budget is small and visible.

what does not fit L4 · L5

Advocacy stakes

Anything where the agent's incentive may diverge from the user's. Recommendations, pricing, retention flows.

Irreversible actions

Transactions, communications, legal-binding writes. Wrong here can't be undone.

Novel ambiguity

Edge cases without prior decisions. Judgment without ground truth is confidence-shaped noise.

Open-ended objectives

"Make this better." "Modernise the product." Without measurable success, autonomy has no compass.

aux evolution curve · the moat

Replaceable in an afternoon. Or part of how the team works.

A four-stage maturity ladder. Most teams shipping AI features are at Stage 01 or 02. The strategic moats start at Stage 03 — when memory, judgment, and embedded vocabulary make the system functionally irreplaceable.

stage 01

Conversational

Natural language replaces forms. User does all the steering. Still a tool.

where most AI features live

stage 02

Task-Aware

Acts on the user's behalf. Watches, adapts in real time. Still session-bound.

copilots in 2026

stage 03

Personally Intelligent

Remembers preferences, goals, recurring tasks. Anticipates. Feels like a colleague.

where the moat begins

stage 04

Socially Embedded

Understands the team, role, shared vocabulary. Part of how the org works.

almost nobody is here

The further right you move, the harder it gets to swap you out. A Stage 01 chatbot is replaceable in an afternoon. A Stage 04 system with six months of context on your team is functionally irreplaceable. That's the moat. It compounds with time.

§07 · the shift

The trust harness compounds.

Every captured failure becomes a permanent edge in the system. Every named gap propagates to every future audit. Every fix lands once and protects every product. The next session starts smarter than the last.

Every repeated incident→a tg.* taxonomy entry.

Every recurring escalation→a contract clause.

Every heuristic violation→a CI gate.

Every advocacy collapse→a policy edit.

Every pattern that lands→an entry in the library.

Be on the relationship. Not in the loop.

You've got the map.

The framework is open and stays open. TrustKit is the substrate — six canonical schemas (aux-heuristics.yaml, trust-architecture.yaml, trust-gap-taxonomy.yaml, trust-contract.yaml, agent-spec.yaml, memory-policy.yaml), the auditable patterns, the canonical vocabulary. Definitions are CC BY 4.0; tooling is MIT. Forkable, citable, not vendor-locked.

When you're ready to apply it to your product, the four auxfirst engagements pick up exactly where this kit ends: Executive Seminar for alignment · Team Workshop for design · Agent Experience Audit for diagnosis · Blueprint Sprint for ship-ready specs.

github.com/auxfirst/trustkit 10 heuristics 24 patterns book an audit

with ideas from · nielsen norman · berkeley CLTC · geoffrey huntley · dexter horthy · matt pocock · steve yegge · jakob nielsen
and from every team that shipped an agent that broke a relationship — receipts, not vibes