Anton, chapter 14: Evidence and authority

The first unprompted message Anton ever sent me arrived without anyone asking it a question.

Someone in the family group mentioned a pickup. A moment later, my phone displayed a quiet heads-up.

No command. No explicit request.

Anton had decided the information was worth surfacing.

Watch mode was finally live.

It was capped at a few interventions a day and silent by default. A proactive assistant can become irritating very quickly, so I wanted Anton to miss opportunities rather than manufacture them.

Seeing the first message work was satisfying.

Then I audited one ordinary interaction with Clara from beginning to end.

It contained three bugs.

A time without a zone

Every timed event Anton had added to the family calendar was two hours late.

The model produced a time as ordinary wall-clock digits: the way a person says "three o'clock."

Somewhere lower in the stack, that naive time was sent to Google as though it were already UTC.

The family lived in Paris.

Every appointment therefore shifted by the local offset.

The bug was obvious once a real event was compared with a real clock and nearly invisible before then. A wrong time still looks like a valid time.

The fix was to resolve every naive wall-clock value in the family's configured time zone before sending it anywhere.

Time is not only digits.

It is digits plus a place.

Anton forgot what Anton said

The second bug lived in the proactive path.

When Anton sent an unprompted message, the delivered message was not added to the conversation history.

Minutes after telling me something, Anton could deny knowing anything about it.

From its perspective, the message had never happened.

The history contained what users said and what Anton said in response. It did not contain what Anton initiated itself.

An assistant that cannot remember what it told you is only marginally less broken than one that cannot remember what you told it.

The conversation record must describe what was actually delivered, not only which request produced it.

The guardrail

The third bug was the most interesting because it came from a safeguard.

Earlier, Anton had announced the current time to the entire family with complete confidence and no evidence.

The resulting guardrail was reasonable:

Before broadcasting a factual claim, verify that the message is grounded. When it is not, suppress it and replace it with an honest failure.

This time, Anton successfully created an event for Clara.

The guardrail examined the confirmation, decided it was unsupported, removed the true message ("Done, I added it") and sent her "Sorry, I couldn't find that" instead.

The event existed.

The action succeeded.

The guardrail against lying produced the lie.

Authority without evidence

The gate could see which tools had been called.

It could not see their results.

It knew a calendar operation had occurred but had no evidence that the operation had succeeded. Blind to the outcome, it chose the conservative answer.

Conservative was wrong because something had happened.

The problem was not that the guardrail made a mistake.

The problem was the mismatch between its evidence and its authority.

It had enough authority to suppress Anton's answer and replace it with another one.

It did not have enough information to judge the action it was overruling.

Worse, the original success message was still written into history.

The audit trail claimed Clara received a confirmation she had never seen.

The system, its checker, and its record all agreed with one another.

Reality disagreed.

That is a particularly dangerous failure because internal consistency can look like truth.

Record what happened

The gate now reads tool results, not only tool names.

A successful write is grounded by the result proving the write occurred. An action already verified inside the agent loop is not judged again at the outbound boundary without new evidence.

Conversation history records the message that actually left the system.

All three bugs shared one theme.

The calendar path lacked the location required to interpret a time.

The conversation history lacked the outbound event required to remember an interaction.

The guardrail lacked the result required to judge an action.

Each mechanism acted with less context than its responsibility demanded.

The lesson I took into August was:

A safeguard needs evidence proportional to its authority.

A check allowed to suppress the truth must be able to see what made the statement true.

A record used for auditing must capture what users actually received.

And a guardrail should be trusted only as far as you can inspect what it saw.

Not one step further.