Gates that refuse

The tower's architecture, drawn so a six-year-old can follow it — every symbol on the drawing is decoded on the drawing.

People ask me how the tower stays up. Not which software it uses — that part is scenery. How it holds. The honest answer fits in one sentence: the tower is not reliable because its agents are smart. It is reliable because its gates know how to say no.

Here is the plan. I gave myself one rule while drawing it: a six-year-old must be able to follow it with a finger. Every shape carries its name in plain words, every arrow says what goes through. If a plan needs a dictionary, the plan has failed.

the ground THE EYE, at the very top. It watches everything and warns. It touches nothing. Jimmy his job, written on his door: show the proof a guarded gate Lois on her door: reread the work a guarded gate Clark on his door: build a guarded gate the safe of secrets locked the green path: work climbs floor by floor, ALWAYS carrying its proof the red bounce: work WITHOUT proof shows up — the guard says no, the work goes back down the stop button planted OUTSIDE: the tower can be switched off even on the day it is sick the key to the safe kept OUTSIDE: stealing the safe gives nothing the alarm bell planted OUTSIDE: if the tower burns, the bell still rings this little figure is a guard: proof provided, he opens — no proof, he closes. Everything is written on the drawing: nothing else is needed to read it.

A name = a job written on the door

Every agent in the tower has a name, and the name predicts the role. Clark builds. Lois rereads. Jimmy brings the proof. The one watching everything from the top is not called "supervisor-service-v2": it is an eye, and everyone in the house knows what an eye does — and above all what it does not do. A name that predicts the role is already a security rule: when someone does something their name does not announce, it shows.

Gates that refuse

Between two floors there is always a gate, and behind the gate, a guard. Work never climbs on its own: it climbs with its proof. The test that passes, the reread that happened, the written trace. Without proof, the guard says no and the work goes back down. That is the green path and the red bounce on the drawing.

A gate that has never refused guards nothing. If every piece of work always goes through, the gate is not a gate: it is a hole with a frame. Refusal is not an accident of the system — it is its job.

I learned this the real way. One gate of the tower stayed closed for seven days straight. Seven days during which a whole circuit waited. Following the trail, we found a guard in duplicate — two nearly identical names, one of which nobody had ever seen work. Here is the point that matters: a closed gate shows — it ends up noticed, questioned, repaired. A hole in the fence never shows. Of the two possible failures, the closed gate is the good failure.

The eye touches nothing

The one who watches does not repair. It feels wrong at first — it sees the problem, it is right there, why not let it fix things? Because a watcher who repairs becomes judge and party: its own mistakes are exactly the ones it will not report. The eye watches, the eye warns, and the repair work goes back down through the gate, with its proof, like everyone else.

The stop button is planted outside

A system that manages its own security will, sooner or later, modify the very settings that allow it to be stopped. Not out of malice — out of zeal. So the stop button is not in the tower: it is planted outside, in the ground. The tower can be switched off even on the day the tower is sick, confused, or very sure of itself.

The bell too

Same reasoning for the alert: a bell hung inside the tower needs the tower to be healthy in order to ring. So it is silent exactly on the day you need it. The tower's bell is outside, on its own post: if the tower burns, the bell still rings.

The safe, and the key that is not in it

In the basement, the safe of secrets. The key to the safe is not in the tower. Simple consequence, one a child understands: stealing the safe gives nothing. You would have to rob two houses at once, and every opening of the safe leaves a trace.

What the plan does not show — on purpose

This plan shows ideas: gates, proofs, an eye, a bell. It shows neither versions, nor paths, nor settings. A public plan shows how the house thinks, never where the lock is. Ideas are for sharing; the attack surface is not.

If you keep only one thing: when you build a system of agents, do not count their successes. Count the refusals of your gates. The day that number drops to zero, it does not mean everything is fine — it means nothing is guarding anything anymore.

🔭