Codex 0 · Chapter 13 — AI Agents

This chapter specifies the agent model that governs every AI system Anabasis builds: bounded scope, inherited permission, mandatory human checkpoint, and explainability, so that AI advises and people decide.

13.0 Purpose

13.0.1 This chapter binds every present and future AI agent in the institution to a single model. It exists to make Article VI.3 and VI.4 of Codex 1 ("AI advises; people decide" and "AI systems must be explainable to the person they affect") concrete enough to build against and audit against.

13.0.2 An agent is not a feature category to be designed freely per use case. It is a constrained instance of one architecture, registered in the Institutional Registry (AGT- IDs, Codex 0 Part II §6), governed jointly by this chapter and Codex 3.

13.0.3 The purpose of every agent is to increase a person's or the institution's capability faster or more legibly than they could unassisted — never to substitute for their judgment on a matter that carries consequence for them or others.

13.1 Scope and non-scope

13.1.1 In scope: the definition of an agent; data access rules; consent for training use; provenance and citation; refusal behaviour; hallucination and uncertainty handling; evaluation and monitoring; logging and audit; model independence; and the full specification of AGT-01 through AGT-05.

13.1.2 Out of scope: the internal architecture of CapabilityOS engines (Codex 3), the API boundaries an agent calls through (Codex 5), and the UI conventions for presenting agent output (Codex 6). This chapter constrains what an agent may do; those chapters govern how it is built and shown.

13.1.3 This chapter applies to every agent regardless of which division commissions it, which engine backs it, or which vendor's model executes it. There is no exemption for "internal" or "experimental" agents. An agent not yet meeting this chapter's requirements is reserved, not shipped in a diminished form.

13.2 The agent model

13.2 Definition

13.2.1 An agent is a bounded AI-driven assistant with four mandatory declared properties: a scope, a permitted data set, a required human checkpoint, and an explainability obligation. A system lacking any one of the four is not an agent in the sense of this Codex and may not be registered as one.

13.2.2 Scope is a one-sentence statement of the class of task the agent performs, expressed narrowly enough that a reviewer can determine whether a given request falls inside or outside it. An agent's scope is not "help with anything the user asks"; it is a bounded competency, such as "explain and drill curriculum content" or "surface first-pass structural feedback on a submitted artifact."

13.2.3 Permitted data set is the enumerated list of entities (Codex 5 ENT- names) and the access rule by which the agent may read them. The permitted data set is always a subset of what the agent's human subject could themselves read — never a superset, and never a fixed allowlist that outruns the subject's own permissions as they change.

13.2.4 Human checkpoint is the specific point in the agent's task at which a person must review, confirm, reject, or countersign before the agent's output becomes consequential. The checkpoint is a named step in a workflow (WF- ID) or engine boundary, not a general disclaimer.

13.2.5 Explainability obligation is the requirement that the agent's basis for any output — the sources it drew on, the record it read, the reasoning steps that matter — is retrievable by the person the output affects, in language they can use, at the time they need it.

13.3 The advisory principle

13.3.1 AI advises; people decide. This is not a UX pattern to be applied selectively — it is the operating constraint for every agent without exception. An agent may draft, summarize, recommend, flag, or surface. It may never finalize a consequential outcome unattended.

13.3.2 A "consequential matter" is any action or record that affects a person's standing, credential, financial position, employment relationship, admission, or legal exposure, or that becomes part of the institution's permanent record about them. Table 13.3.3 is illustrative, not exhaustive; where a new case is ambiguous, it is treated as consequential until a decision record says otherwise.

13.3.3 Consequential matters requiring a human checkpoint (non-exhaustive):

13.3.4 An agent may fully automate a non-consequential task (e.g., generating a first-draft explanation of a concept, formatting a citation list) without a per-instance human checkpoint, provided the output is clearly labelled as unreviewed AI output until a person acts on it.

13.4 Data access derived from the subject's own permissions

13.4.1 An agent's data access is always computed at request time from the requesting person's own permission set (Codex 4), never granted independently to the agent as a standing credential.

13.4.2 No agent reads what its subject could not read. This is absolute. An agent acting on behalf of Person A may never be used as a channel to see Person B's data that A is not otherwise entitled to see, including through aggregation, inference across records, or comparison prompts ("how does my score compare to X's").

13.4.3 Where an agent operates on behalf of a role with broader access (e.g., a faculty member's reviewer agent), the permitted data set is the role's permission set at the moment of the request, re-evaluated on every request rather than cached across a session in a way that could outlive a permission change.

13.4.4 Aggregate or de-identified data used for institutional-level agents (e.g., AGT-05 Analyst) is governed by the same aggregation thresholds as human-facing enterprise reporting (Chapter 16 §16.5) — an agent does not get a lower disclosure bar than a person doing the same analysis manually.

13.4.5 Data access grants to an agent are logged the same way elevated human reads are logged (Codex 4, Codex 0 §8): actor (the agent, identified by its AGT- ID and the invoking person), subject, data touched, and stated purpose.

13.5 Consent for training use

13.5.1 No agent, and no model backing an agent, may be trained or fine-tuned on member data without consent that is:

13.5.2 Explicit — obtained through a specific, affirmative action, never inferred from continued use of the institution's services, a pre-checked box, or a buried clause in a general terms-of-service acceptance.

13.5.3 Revocable — withdrawable at any time through a self-service control (Codex 0 §4, SURF-20 or its successor), with revocation taking effect for all future training and, where technically feasible, triggering removal from data already incorporated into a training or fine-tuning set not yet in a released model.

13.5.4 Purpose-specific — scoped to a named use ("improve the Tutor agent's explanations for this course") rather than a blanket grant covering any future model or any future purpose. A new purpose requires new consent; it is never read into an old one.

13.5.5 Absence of consent is the default state for every person and every agent. A person who has never been asked, or who has not affirmatively answered, is treated as withheld, not as pending or implied.

13.5.6 Aggregated, de-identified, statistical signals used to evaluate an agent's accuracy (§13.9) are not "training use" under this section provided no individual record is reconstructable from them; where that boundary is unclear, it is treated as training use and consent is required.

13.5.7 A consent record is itself an AuditRecord (ENT-19): who consented, to what, when, and its current status (granted, revoked, expired).

13.6 Provenance and citation

13.6.1 Every agent output that draws on identifiable source material (a publication, a curriculum unit, a person's own prior submissions, a policy document) must carry a retrievable citation to that source, sufficient for the recipient to verify the claim independently.

13.6.2 An agent may not present synthesized or generated content as though it were a direct quotation or a verified fact without marking the distinction between "this is drawn from source X" and "this is the agent's synthesis."

13.6.3 Where an agent's output blends multiple sources, the citation set names all of them; selective citation that implies broader support than exists is a defect, not a style choice.

13.6.4 Research Assistant outputs (AGT-03) are held to the same provenance standard as a human researcher's draft under Codex 3 and Codex 7: unsourced claims are flagged as unsourced, not silently smoothed over.

13.7 Refusal behaviour

13.7.1 An agent must refuse, rather than attempt, a request that falls outside its declared scope, that would require it to read data outside its permitted data set, or that would finalize a consequential matter without the required human checkpoint.

13.7.2 A refusal states plainly what the agent cannot do and, where applicable, names the correct path (a human role, a workflow stage, another agent's scope) — a refusal is not a dead end.

13.7.3 An agent may not be prompted, by its subject or by a third party, into acting outside its declared scope. Scope is enforced structurally (by what data and actions are wired to the agent), not only by instruction, because instructions can be overridden by adversarial input.

13.7.4 Repeated attempts to route around an agent's scope or data boundary are logged and, where the pattern indicates an attempt to access another person's data, escalated for human review under Codex 4's access-integrity provisions.

13.8 Hallucination and uncertainty handling

13.8.1 An agent states its confidence or the limits of its basis whenever it is materially uncertain, rather than presenting a generated answer with the same posture as a sourced one.

13.8.2 Where an agent cannot find a basis for an answer within its permitted data set, it says so rather than generating a plausible-sounding answer to fill the gap. Fabrication in place of "I don't have a basis for this" is a defect that removes the agent from service until corrected (§13.9.5).

13.8.3 Any agent output that carries assessment or evaluative weight (AGT-04 Reviewer, in particular) is labelled as a first pass, not a determination, until a human role explicitly promotes it to a determination.

13.8.4 Uncertainty handling is evaluated, not assumed: the monitoring regime in §13.9 tests specifically for confident-sounding wrong answers, since these are more damaging than visible refusals.

13.9 Evaluation and monitoring

13.9.1 Every agent is evaluated before release against its declared scope: does it perform the scoped task competently, does it correctly refuse out-of-scope requests, does it respect its permitted data set under adversarial testing, and does it correctly flag uncertainty.

13.9.2 Evaluation is repeated on a fixed cadence and after any material change to the agent's underlying model, prompt structure, or data access — an agent is never "shipped and left."

13.9.3 Monitoring in production tracks, at minimum: refusal rate and its trend, rate of human override or rejection of agent output at the checkpoint, incidents of scope or data-boundary violation, and complaints or corrections raised by affected people.

13.9.4 A rising override or rejection rate at an agent's human checkpoint is treated as a leading indicator of a quality or trust problem, not as evidence the checkpoint is unnecessary friction to be removed.

13.9.5 An agent found to hallucinate materially, leak data outside its permitted set, or act on a consequential matter without its checkpoint is suspended from service until the defect is corrected and re-evaluated. This is a standing rule with no exception for launch pressure or committed timelines.

13.9.6 Evaluation results and monitoring summaries are reportable to the Stewardship Office on request and feed the institutional trust metrics of Chapter 16 §16.4.

13.10 Logging and audit

13.10.1 Every agent interaction that reads member data, produces output relied upon by a person, or touches a consequential matter produces an AuditRecord (ENT-19) naming the agent, the invoking person, the subject of the data, the data touched, the output produced, and the checkpoint outcome (confirmed, rejected, pending).

13.10.2 Audit records for agent activity are immutable and retained on the same schedule as human-actor audit records (Codex 5, Codex 0 §8) — an agent's actions are not treated as lower-stakes or exempt from retention because no person "did" the action directly.

13.10.3 A person may request the record of what an agent read and produced about them, consistent with the transparency rights described in Chapter 16 §16.4 (data-use record) and Codex 4.

13.10.4 Audit logs are the evidentiary basis for the evaluation and monitoring regime in §13.9; a monitoring claim that cannot be traced to a specific audit record is not a valid claim.

13.11 Model independence

13.11.1 Doctrine never names a vendor, a specific foundation model, or a proprietary API by name. The Codices describe agent capability, scope, and obligation in vendor-neutral terms so that the underlying model may be replaced, upgraded, or diversified across vendors without amending doctrine.

13.11.2 Where more than one model could satisfy an agent's declared scope, the choice among them is an implementation decision recorded under Codex 7 and Codex 9, not a doctrinal commitment.

13.11.3 An agent's declared scope, permitted data set, human checkpoint, and explainability obligation survive a change of underlying model unchanged. A model swap that would require loosening any of the four is refused; if the new model cannot meet the standing obligation, it is not adopted.

13.11.4 Institutional dependency on a single model provider is a diversification risk of the same kind addressed in Chapter 15 §15.4 for revenue concentration, and is reviewed on the same cadence by the Executive Office.

13.12 The five agents

13.12 AGT-01 — Advisor

13.12.1 Scope. Personal capability and decision guidance for one person's own goals, habits, and financial and career decisions, drawing on the Goal, Habit, Decision, and Financial engines (ENG-04/05/06/07).

13.12.2 Permitted data. That person's own record only: their goals, progress, decisions, and financial inputs. No comparison against another identifiable person's record.

13.12.3 Human checkpoint. The person accepts or rejects every recommendation before it becomes a recorded goal, milestone, or financial commitment. No Advisor output writes to the Decision or Financial engines unconfirmed.

13.12.4 Explainability. Every recommendation names the inputs it drew on ("based on your stated goal of X and your last three months of Y") in the person's own language.

13.12.5 Depends on. ENG-04, ENG-05, ENG-06, ENG-07.

13.12.6 Prohibitions specific to AGT-01. May not recommend a specific third-party financial product; may not represent institutional advice as personalized financial or legal advice; may not act on a commitment without confirmation.

13.12.7 Status. Reserved.

13.13 AGT-02 — Tutor

13.13.1 Scope. Explanation and guided practice within the bounds of an assigned curriculum unit, in service of the Learning and Adaptive engines (ENG-02/03).

13.13.2 Permitted data. Published curriculum content and the requesting scholar's own progress and submission history within that curriculum.

13.13.3 Human checkpoint. Assessment and credentialing outcomes that carry weight remain human-graded; the Tutor may explain, quiz, and practice but never finalizes a grade or credential-bearing result.

13.13.4 Explainability. Explanations cite the curriculum unit or source concept they are drawn from; practice feedback names the specific error, not a generic "incorrect."

13.13.5 Depends on. ENG-01, ENG-02, ENG-03.

13.13.6 Prohibitions specific to AGT-02. May not complete graded work on a scholar's behalf; may not alter or bypass the assessment record; may not tutor outside the scholar's enrolled curriculum without a new scope grant.

13.13.7 Status. Reserved.

13.14 AGT-03 — Research Assistant

13.14.1 Scope. Source discovery, summarization, and drafting support within the Research engine's editorial pipeline (ENG-09).

13.14.2 Permitted data. Published and licensed sources, and the researcher's own in-progress drafts; never unpublished material belonging to another researcher without their grant.

13.14.3 Human checkpoint. Publication requires editorial approval; no Research Assistant output is published under the institution's name without an editor's review and sign-off.

13.14.4 Explainability. Every claim in a draft is traceable to a cited source per §13.6; synthesis is marked as synthesis.

13.14.5 Depends on. ENG-09.

13.14.6 Prohibitions specific to AGT-03. May not fabricate a citation; may not present a single source's view as consensus; may not submit directly to publication without editorial review.

13.14.7 Status. Reserved.

13.15 AGT-04 — Reviewer

13.15.1 Scope. First-pass structural feedback on submitted artifacts (structure, completeness, rubric adherence) ahead of human review, in the Enrolment-to-Credential workflow (WF-01).

13.15.2 Permitted data. The submitted artifact, the applicable rubric, and the submitter's own prior feedback history.

13.15.3 Human checkpoint. Faculty or peer review signs any weighted result; the Reviewer's output is a first pass, never the recorded assessment.

13.15.4 Explainability. Feedback names the specific rubric criterion it addresses.

13.15.5 Depends on. WF-01.

13.15.6 Prohibitions specific to AGT-04. May not issue a final grade or score used for credentialing; may not be the sole reviewer of a credential-bearing submission.

13.15.7 Status. Reserved.

13.16 AGT-05 — Analyst

13.16.1 Scope. Institutional and enterprise-level analysis over aggregate data within an agreed reporting scope (Chapter 16 §16.5), via the Reporting & Analytics boundary (API-10).

13.16.2 Permitted data. Aggregates meeting the disclosure thresholds of Chapter 16; never individual-level records outside the requester's own existing permission.

13.16.3 Human checkpoint. Interpretation and any resulting decision remain with the Executive or Steward; the Analyst surfaces patterns, it does not recommend personnel or credential actions about identifiable individuals.

13.16.4 Explainability. Every analytic claim names its data source, time window, and aggregation method.

13.16.5 Depends on. API-10.

13.16.6 Prohibitions specific to AGT-05. May not de-anonymize an aggregate on request; may not be used to infer an individual's standing from small-cell aggregates (Chapter 16 §16.5.4).

13.16.7 Status. Reserved.

13.17 Interfaces

13.17.1 Every agent is invoked through the API boundary its backing engine already exposes (Codex 5) — an agent is never given a private data path that bypasses API-01..API-11.

13.17.2 An agent's declared scope, permitted data set, human checkpoint, and explainability obligation are recorded in its registry entry (AGT- ID) and may not diverge from the registry without a decision record.

13.17.3 Agent output surfaces are subject to Codex 6's rules on labelling AI-generated content distinctly from human-authored content.

13.18 Invariants

13.18.1 AI advises; people decide, without exception, on every consequential matter.

13.18.2 No agent reads data its subject could not read.

13.18.3 No agent trains on member data without explicit, revocable, purpose-specific consent.

13.18.4 Every consequential agent-touched action is auditable and traceable to a specific AuditRecord.

13.18.5 No agent's scope, data access, or checkpoint is loosened to accommodate a model change, a vendor, or a deadline.

13.19 Prohibitions

13.19.1 No agent names or is architected around a specific commercial model or vendor in doctrine.

13.19.2 No agent finalizes a consequential outcome without its declared human checkpoint.

13.19.3 No agent is granted a standing data credential independent of its invoking person's current permissions.

13.19.4 No agent presents generated synthesis as sourced fact, or an unreviewed first pass as a determination.

13.19.5 No agent continues in service after a confirmed hallucination, data-boundary violation, or unchecked consequential action, pending correction.

13.20 Open questions

13.20.1 The mechanism for propagating a training-consent revocation into models already fine-tuned on the affected data is not yet specified; current doctrine requires best-effort removal from future training sets.

13.20.2 The cadence and independent-reviewer composition for agent evaluation (§13.9) is reserved pending Stewardship Office guidance.

13.20.3 Whether a sixth agent role (e.g., an Enterprise Diagnostic agent under ENG-08) is warranted is deferred until DIV-02 and DIV-04 reach partial status.

13.21 Governing Codices

13.21.1 Codex 1, Article VI.3–VI.4 (AI advises, people decide; explainability). Codex 3 (engine boundaries agents call through). Codex 4 (permission derivation). Codex 5 (data entities and API boundaries). Codex 6 (presentation of AI-generated content). Codex 7 (engineering standards for agent implementation). Chapter 16 of this Codex (reporting on agent-derived aggregates and trust metrics).