RAND's 2024 work on AI in wargaming lands on a line we built the whole platform around: AI should assist human judgment, not replace it. Stated as product law, it becomes: the agent may draft anything and decide nothing.
That sounds like a slogan until you try to ship it. The honest version has teeth, because the convenient thing is almost always to let the agent close the loop — auto-publish the alert, auto-commit the consequence, auto-send the notification. Every one of those is a small theft of the human's authorship, and they compound.
What "never decides" actually constrains
In practice the constraint is a taxonomy of outcomes. An agent may auto-apply only outcomes that are internal and reversible — attach an observation, flag an entity, raise an alert, open a watch-status case — and only above a high confidence threshold. Anything customer-facing or irreversible — a report draft, a published artifact, an external notification — always stages for a human to accept, modify, or reject.
Detect and draft, continuously. Commit, only with a human.
The staging surface is a proposal inbox. Each proposal carries its grounding: the cited observations, the tool-use trace, and the reasoning, one click away. Accepting it commits an ordinary event to the canonical model, logged with who and when. The human is not rubber-stamping a black box; they are reviewing a draft with its sources attached.
The features we resisted
We were asked, more than once, for an "autopilot" mode — let the watch fire and act overnight, review in the morning. We said no, and not for liability theatre. The value of the output to a regulated buyer is the human commitment. A report that a person signed is admissible in a way an autonomous one is not, in compliance, in journalism, in insurance, in policy.
So the refusal is also the product. "AI supports, never decides" is not a safety disclaimer bolted on at the end. It is the reason the artifact is worth anything when it leaves the room.
The agent opens the pull request. A human merges it. The canonical model is a protected branch — there is no path that writes to it without a name attached.