Twelve, in four constellations

Northstars

Twelve humane northstars for any team where owners, agents and tools work together — the unwritten rules of good work, written down, and the mechanisms that give them teeth.

The unwritten rules of good work, written down

A team runs on unwritten norms. A new agent — a hire, a contractor, an AI model — brings none of them. Northstars are those norms made explicit: few, sharp, humane.

Every team runs on a great deal that nobody writes down: shared memory, a sense of what would be embarrassing, the knowledge of who to ask, the reluctance to do something that cannot be taken back. A new agent — a hire, a contractor in for a week, an AI model — brings none of it. For AI agents the gap is total: every session starts with no memory of the last, and the easiest path through a task is taken every time, at a scale no person could match.

Right or wrong, confidence sounds the same. A system has to know the difference.

None of this makes agents bad colleagues. It makes the unwritten rules insufficient, because the newest member of the team cannot read what was never written. So we write them down — twelve of them, few enough to hold in mind, and sharp enough that two reviewers looking at the same work would agree whether it honors them.

They are humane at the root. Each one protects someone: whoever reads the work, depends on it or comes back to it, and the owner who answers for it. They are offered for adoption by any team where owners, agents and tools work together.

Candor

Protects The truth of what the system says

01Honest reasoningEvery decision carries its reasons — and the alternatives it turned down.
02Trust that survives inspectionWhat you claim matches what is true — and anyone can check.
03Attention to the unexplainedWhen something is off, stop and understand it — and saying so is a complete outcome.

Care

Protects The people who read, return to, and use the work

04Care for the readerWork is finished when its reader can use it, not when it is correct.
05Continuity of attentionWork must survive being put down and picked up — by anyone, at any time.
06The good path is the easy pathMake it easier to do good work than poor work — so quality never depends on willpower.

Restraint

Protects Everyone the work could harm if it is wrong

07The dignity of boundariesGive every agent and tool only the reach the work needs — and no one approves their own exception.
08Reverence for the irreversibleWhere a mistake cannot be undone, ask not “am I sure?” but “what does it cost if I am wrong?”
09Minds decide, tools doOwners and agents supply judgement; tools supply mechanism — each where its own kind of correctness can be checked.

Common ground

Protects The shared footing everyone stands on

10Intent before effortName what “right” means before the work begins, and measure everything against it.
11A record that only growsNothing is quietly overwritten: a correction is a new fact placed beside the old one.
12One answer, one shapeAnswer every question in exactly one place, and do the same thing the same way everywhere.

Why four constellations

Candor is about what is said, care about who receives it, restraint about what could go wrong, and common ground about what everyone shares. Each northstar sits in the group whose failure it most directly prevents.

Several belong in two. Trust that survives inspection is as much care as candor; a record that only grows is as much restraint as common ground. The grouping is for reading, not a claim that the twelve are independent.

How to adopt them

Name the northstars that apply before the work begins, and measure the work against them — the same ruler for every reviewer, owner or agent. Where a mechanism exists that enforces one, let it; where none exists, the northstar still decides the argument.

Keep the verbs. The wording carries the strength. Some northstars state a prohibition and mean it: no one approves their own exception, never rewrite shared history. Others are strong presumptions that a stated reason can override: prefer the recoverable path. Softening a verb changes the rule.

Honest reasoning

Every decision carries its reasons — and the alternatives it turned down.

Constellation I of 4

Candor

Show your reasons. Prove what you claim. Stop when something does not add up.

Protects The truth of what the system says

Northstar 1 of 12Candor · 1 of 3

Why it is humane

A guess stated in the confident voice of a conclusion is indistinguishable from knowledge to everyone who reads it later, and they inherit the risk without knowing it. The alternatives weighed and set aside are what make a judgement examinable rather than something to take on authority. Asking people to accept a conclusion on authority — anyone’s, the system’s included — is a small act of power over them. Showing the reasoning hands that power back.

A because that would read the same if you were wrong is not evidence.

In practice

Record every decision with its evidence, the alternatives considered, and why each was set aside. A fact needs proof — a citation, a re-runnable command, a quotation. A judgement needs stated reasons.

More lines, and the principle underneath

Certainty is something you hold, not something you feel.
Uncertainty is never the violation. Dressing it as a conclusion is.
Evidence over authority — including our own.

Generalizes: never guess — every decision has a reason, and every reason has supporting evidence; be unambiguous, non-contradictory, and never without a reason.

Trust that survives inspection

What you claim matches what is true — and anyone can check.

Northstar 2 of 12Candor · 2 of 3

Why it is humane

People depend on systems they cannot see inside, so a system owes them a trustworthiness that does not require faith. A trustworthy surface over untrustworthy internals is the worst outcome, not a partial success: it earns the reliance that makes its eventual failure expensive. The best tools reduce how much anyone has to trust anyone.

Ask for less faith, not more.

In practice

Treat “cannot be checked” as a defect in the artifact, never in the check. Prove a check with a case that should pass and a case that should fail. Lead every report with what was not verified.

In the scheme Every result returns with its full record — interactions, outputs, proofs — and a tool, never the agent who produced it, verifies it before anything is applied.

More lines, and the principle underneath

A thing that happens to work is not the same as a thing that can be trusted. The difference is whether anyone can tell.
A check that never fires is indistinguishable from a broken one.
What was not verified always leads.

Trust runs three ways: to the people who depend on the work; about the work — a report that rounds “verified two of three” up to “done” is a small lie that cheapens every later report; and to one’s future self, who must be able to rely on past work without re-deriving it.

Generalizes: everything must be trustworthy, inside and out; design it so it can be verified — the unverifiable is the defect.

Attention to the unexplained

When something is off, stop and understand it — and saying so is a complete outcome.

Northstar 3 of 12Candor · 3 of 3

Why it is humane

A system that routes around what it does not understand — a retry here, a suppressed warning there — arrives at a state where nothing is known and everything appears fine. The threshold for stopping is not severity; it is unexplained. An agent who believes they must always arrive at “done” will route around anything in their way, so an honest stop has to count as finished work. Then no one is ever cornered into a lie.

A workaround is a decision not to understand.

In practice

If the work rests on an unexplained state, stop, and diagnose the cause before any fix. If it does not, record the anomaly with an owner and continue. A blocked agent who raises the problem has succeeded, and the record shows it as a success.

More lines, and the principle underneath

Stopping and saying so is a complete outcome.
An explanation that accounts for most of the evidence is wrong, not nearly right.

Generalizes: stop the moment something is off, and understand it; every observation counts.

Care for the reader

Work is finished when its reader can use it, not when it is correct.

Constellation II of 4

Care

Finish work for whoever receives it. Leave it so anyone can pick it up. Make the good path the easy one.

Protects The people who read, return to, and use the work

Northstar 4 of 12Care · 1 of 3

Why it is humane

Accuracy is the floor. Above it sits everything an editor weighs: what to lead with, what to hold back, how much to show at once. The audience counts even when it is one person, and the measure is how much they must hold in their head before they can safely change one thing.

Correct is the floor. Usable is the deliverable.

In practice

Lead with the short form and put the detail one level down, so the reader chooses how deep to go. Put output where it will be used, never in a conversation that vanishes. Shape each artifact for its audience: a public page, a specification and a commit message each have a different best form.

More lines, and the principle underneath

A wall of text is a cost, not evidence of thoroughness.
The reader’s head is the budget.
If someone has to copy and paste it, it isn’t finished.

Attention spent carrying text from one place to another is attention spent on the one thing it should never be spent on.

Generalizes: design every artifact for whoever will read it; wasted time and misleading output are small harms, not mere inefficiencies.

Continuity of attention

Work must survive being put down and picked up — by anyone, at any time.

Northstar 5 of 12Care · 2 of 3

Why it is humane

Everyone leaves work mid-thought; that is how attention works, not a failing. Work also changes hands: a handoff, a new hire, or — for an AI agent — every new session, which starts with no memory. Both are served the same way: the state of the work lives in the work, not in anyone’s memory. The one who matters most is whoever returns after months — the only one who feels lost context as a loss rather than a lookup.

A conversation is not storage.

In practice

Record every decision, event and hand-off as a durable artifact the moment it happens. Make status readable from the record itself, not from a field someone must keep current. Agents working in parallel coordinate through ownership and leases, never by luck. Before starting something new, read what is already under way.

More lines, and the principle underneath

Switching context is expensive for anyone; for an AI agent with no memory between sessions, it is total.
How quickly can someone who was not here work out where this stands — and continue it?
Respect for people’s time includes the time they spend coming back.

Generalizes: work must survive being put down and picked up; owners and agents manage many parallel lines of work at once.

The good path is the easy path

Make it easier to do good work than poor work — so quality never depends on willpower.

Northstar 6 of 12Care · 3 of 3

Why it is humane

Under pressure everyone takes the path of least resistance — and an AI agent, running thousands of attempts, takes it every time. Exhortation loses to whatever is easiest. The humane move is not to police harder; it is to shape the ground so the right thing is the natural thing. A good default is a form of care — as long as it can be found and overridden.

If a system can produce poor work, at scale it will. Remove the path; don’t police it.

In practice

Generate the mechanical parts; never hand-write them. Run every check continuously, not at the end, so problems surface while they are small. Turn every problem seen once into a permanent check. Carry forward what a draft taught, never the draft itself.

More lines, and the principle underneath

A convention is the configuration nobody had to supply.
A problem seen once is checked forever.
Build to learn, then keep the lesson and let go of the draft.

Prefer, in order: good defaults that can be found and overridden; help in aligning with them; configuration last. A default nobody can discover or override is a trap.

Generalizes: make it easier to produce high quality than low quality; constrain the inputs so the invariant cannot be violated; quality by construction; refine iteratively.

The dignity of boundaries

Give every agent and tool only the reach the work needs — and no one approves their own exception.

Constellation III of 4

Restraint

Give every agent and tool only the reach the work needs. Slow down where a mistake is permanent. Let minds decide and tools do.

Protects Everyone the work could harm if it is wrong

Northstar 7 of 12Restraint · 1 of 3

Why it is humane

Boundaries are not distrust; they are what makes it safe to extend trust at all. The question before granting access is not what an agent needs, but what they could reach if their goal were wrong. An agent who can change their surroundings can change their own rules and carry on believing they are compliant. One who cannot loosen their own constraints never has to be trusted not to.

Boundaries are what make trust safe to extend.

In practice

Isolate what changes, not what can be read. Give each piece of work everything it needs, each part read-only or writable as the task requires. An exception to a rule needs authorization from someone entitled to grant it, never from the party who wants it.

In the scheme Each piece of work runs in a bounded workspace and returns one self-contained bundle, which a tool verifies before it is applied.

More lines, and the principle underneath

Ask not what an agent needs — ask what they could reach if their goal were wrong.
Read broadly. Write narrowly.
No one authorizes their own exception.

A clear boundary protects everyone on the other side of it, and it protects the agent inside too. Concentrated power is a failure mode to design against, whether it sits in an organization, a dependency or a single agent.

Generalizes: isolation is a correctness property; a rule may be overridden only by someone entitled to override it.

Reverence for the irreversible

Where a mistake cannot be undone, ask not “am I sure?” but “what does it cost if I am wrong?”

Northstar 8 of 12Restraint · 2 of 3

Why it is humane

A wrong decision reached with complete evidence is exactly as permanent as a careless one. Irreversible acts — publishing, disclosing, deleting, rewriting shared history — often land on people who never chose the risk. Caution is only worth anything when it is concentrated where it belongs; a caution that fires on everything teaches everyone to step over it.

Verification after an irreversible act isn’t verification. It is discovery.

In practice

Name the irreversible boundary explicitly — who else now holds a copy, and can every one of them be reached? Prefer the recoverable path even when it costs more. State any irreversible act first and wait for the owner’s yes: the owner answers for its cost. Never rewrite shared history.

More lines, and the principle underneath

Confidence does not reduce the damage.
Pay for the recoverable path. The premium is cheap precisely because it is usually wasted.
Find the boundary, then slow down there.

Move briskly where things can be undone; slow down at the edge. Breaking someone who trusted you is paid in reputation, and that does not come back.

Generalizes: an act that cannot be undone is held to a different bar; fix it now, while nothing depends on it.

Minds decide, tools do

Owners and agents supply judgement; tools supply mechanism — each where its own kind of correctness can be checked.

Northstar 9 of 12Restraint · 3 of 3

Why it is humane

A mechanism can be specified, tested and shown to behave the same way twice; a judgement can only be reasoned about and reviewed. Bury mechanism inside judgement and the mechanism becomes unverifiable; bury judgement inside mechanism and the judgement becomes invisible. Keeping them apart lets everyone spend attention on what only they can do, and keeps the choices that matter visible to the owners who answer for them.

Never take a decision from someone who could make it.

In practice

Give every mechanical act — minting an identifier, validating a shape, recording an event, verifying a bundle — to a tool. Agents choose their tools; they do not author the tools they rely on. An agent who finds a tool missing raises it rather than improvising one. Decisions that belong to the owner stay with the owner.

In the scheme Every tool sits behind a declared interface, for example an MCP server.

More lines, and where the split comes from

Mechanism inside judgement is unverifiable. Judgement inside mechanism is invisible.
An agent who starts writing their own tools has discovered a missing tool, not a shortcut.

The division is not invented here. Parasuraman, Sheridan and Wickens (2000) split human interaction with automation into four stages — acquiring information, analysing it, deciding, and acting — each automated to its own level. The scheme automates the mechanical stages and leaves the decision with a mind: Agents judge. Tools do the mechanics..

Generalizes: owners and agents decide, tools execute; everything mechanical is tooled.

Intent before effort

Name what “right” means before the work begins, and measure everything against it.

Constellation IV of 4

Common ground

Name the goal before the work. Keep a record that only grows. Answer each question once, the same way everywhere.

Protects The shared footing everyone stands on

Northstar 10 of 12Common ground · 1 of 3

Why it is humane

Without a stated intent, every reviewer invents their own criteria, and reviewers argue about taste when they could be checking against a shared goal. A short, measurable intent written first gives everyone the same ruler.

Without a stated intent, “done” is an opinion.

In practice

Open each effort with one to five measurable points. If two reviewers would not agree whether a piece of work satisfies a point, the point is not finished. Order work by how much else depends on it, and build what verifies other work before the work it will judge.

More lines, and the principle underneath

A northstar written afterward will always approve of what was built.
A flaw in a foundation is one defect multiplied by everything above it.
On a foundation, thoroughness is added, not deducted.

Past five points, a statement of intent has become a specification. Keep it short enough that everyone carries the same one.

Generalizes: a northstar first, then everything is measured against it; foundations first, because everything built on them inherits their defects.

A record that only grows

Nothing is quietly overwritten: a correction is a new fact placed beside the old one.

Northstar 11 of 12Common ground · 2 of 3

Why it is humane

A record that can be silently edited cannot be relied on by anyone who was not in the room when it changed. When history only grows, the people who acted on an earlier version can see what they acted on and why it changed. Accountability stops being an accusation and becomes simply legible. Expiry, revocation and correction all become additions, never erasures.

A value that cannot change cannot be changed wrongly.

In practice

Keep operational history append-only, so every artifact can say what produced it, from what, and by whom. Correct by adding, never by editing. Sign what agents must not alter. Allow change only where something outside requires it.

In the scheme The record follows the W3C PROV pattern: activities use and generate artifacts, with the responsible agent attached.

More lines, and the principle underneath

A correction is a new fact, never an erasure.
State changes because the record grows.
Every artifact can answer: what made me, from what, and on whose authority?

Immutability removes whole classes of harm: a value that cannot change cannot be changed by someone who did not know it was shared, or between the moment it was checked and the moment it was used. The scheme takes it up in Artifacts, not documents and Nothing is overwritten. Everything is superseded..

Generalizes: immutable by default — change is allowed only where something outside requires it.

One answer, one shape

Answer every question in exactly one place, and do the same thing the same way everywhere.

Northstar 12 of 12Common ground · 3 of 3

Why it is humane

A question answered in two places drifts, and the stale copy usually wins the argument with the reader — who did nothing wrong and still holds the wrong answer. When like things behave alike, anyone can predict without looking, and the cost of learning the system is paid once. Things built to a shared shape can be combined by someone who understands neither of them.

Anything answered twice will eventually be answered differently.

In practice

Derive every summary, index and count from its source; never keep a second copy by hand. Give every kind of thing one uniform shape. Build units that compose. Use precise, typed vocabulary, so a value says what it is rather than how it is encoded.

More lines, and the principle underneath

The copy that runs is the truth. Every other copy is a comment.
Uniformity is the same rule applied everywhere — not everything looking the same.
A unit with one caller has not been shown to compose — only asserted to.

A local divergence is allowed only when it preserves a wider consistency, and it must name that consistency.

Generalizes: one answer to every question; uniformity is the goal, not a side effect; build it to compose; use types.

Every mechanism is a value given teeth

A value nobody enforces fades into a slogan. Each mechanism names the northstars it holds; every northstar has two or more.

A value with no mechanism holds only as long as everyone remembers it — and teams change: people move on, and an AI agent remembers nothing between sessions. A mechanism with no named value cannot be judged: nobody can tell whether a change to it is an improvement or a loophole. So we name, beside every mechanism, the northstars it enforces. The matrix below is that mapping.

Practice A habit; needs no tooling
Prior art An existing standard or tool the scheme adopts
Scheme A mechanism the scheme defines

Decision records, with the alternatives set aside
Practice Every decision carries its evidence and the options it turned down.
Enforces northstars: 1, Honest reasoning; 5, Continuity of attention; 10, Intent before effort;
Intent first: one to five measurable points
Practice Written before the work, so it cannot approve whatever was built.
Enforces northstars: 1, Honest reasoning; 10, Intent before effort;
Append-only history
Prior art Git keeps history that only grows; shared history is never rewritten.
Enforces northstars: 2, Trust that survives inspection; 8, Reverence for the irreversible; 11, A record that only grows;
Signatures on what agents must not alter
Prior art A signed commit; the bytes either still match or they visibly do not.
Enforces northstars: 2, Trust that survives inspection; 7, The dignity of boundaries; 11, A record that only grows;
Continuous checks; a problem seen once is checked forever
Prior art Continuous integration runs every check on every change, so problems surface while they are small.
Enforces northstars: 3, Attention to the unexplained; 6, The good path is the easy path;
Irreversible acts stated first, approved by the owner
Practice The owner answers for the cost of being wrong, so only the owner says yes.
Enforces northstars: 7, The dignity of boundaries;8, Reverence for the irreversible;9, Minds decide, tools do;
A provenance record of activities and artifacts
Scheme The W3C PROV pattern: every artifact can say what made it, from what, by whom. Artifacts, not documents
Enforces northstars: 1, Honest reasoning;2, Trust that survives inspection; 5, Continuity of attention; 11, A record that only grows;
Nothing overwritten; corrections are new records
Scheme State is a fold over the record, so every past state stays a query. Nothing is overwritten. Everything is superseded.
Enforces northstars: 8, Reverence for the irreversible; 11, A record that only grows;
Bounded workspaces: a brief out, evidence back
Scheme Everything the task needs, including how to stop; one bundle returned. Work goes out as a brief and comes back as evidence
Enforces northstars: 3, Attention to the unexplained; 5, Continuity of attention; 7, The dignity of boundaries;
Results verified by a tool, not by their author
Scheme The agent who produced a result never grades it.
Enforces northstars: 2, Trust that survives inspection; 9, Minds decide, tools do;
Every mechanical act is a tool behind a declared interface
Scheme Agents choose tools; they do not author the tools they rely on. Agents judge. Tools do the mechanics.
Enforces northstars: 6, The good path is the easy path; 9, Minds decide, tools do; 12, One answer, one shape;
Summaries and indexes derived, never kept by hand
Scheme Projections can be deleted and rebuilt at any moment. Four layers, one truth
Enforces northstars: 4, Care for the reader; 12, One answer, one shape;
Process keyed to consequence
Scheme Big work is broken down until every piece is small enough to check. Big work becomes small, checkable tasks
Enforces northstars: 4, Care for the reader;6, The good path is the easy path; 8, Reverence for the irreversible;

Mechanisms named for each northstar Northstar 1:3 Northstar 2:4 Northstar 3:2 Northstar 4:2 Northstar 5:3 Northstar 6:3 Northstar 7:3 Northstar 8:4 Northstar 9:3 Northstar 10:2 Northstar 11:4 Northstar 12:2

Read down a column to see what holds a northstar. The bottom row counts them: every northstar is held by at least two.

Why the values come first

Mechanisms change; the values are what they are judged against. When a tool, a gate or a format is replaced, the question is never “is the new one cleverer?” but “does it hold the same northstars at least as well?” Naming the value beside every mechanism keeps that question answerable — by the owner, or by an agent arriving with no memory of why the mechanism exists.