Systems · Engineering Governance
Engineering discipline that survives the agent doing the work.
Make the work accountable. When an AI writes the code, verification stops being part of the job and becomes the whole job. AES is the method Knowlton built to answer one question at every step: how do we know that's true?
Why it exists
The bottleneck moved
Agent-assisted development removes the constraint that used to govern software: how fast a person can type. What it does not remove — what it makes far worse — is the problem of knowing whether what came out is real, and whether it was right for your system rather than for software in general.
An agent will produce something plausible for any instruction. It will describe work as complete. It will report a test as passing in the same confident register it uses for a test it never ran. The output looks identical either way, and it arrives faster than anyone can check it.
So the discipline has to move too. AES is what we built instead of trusting the output.
The method
Four ideas that carry most of the weight
“Not run” is a verdict
Most checklists offer pass and fail. The category that actually matters is the third one — the check nobody executed. AES makes not run a first-class result, so an unexercised claim can never be mistaken for a verified one.
The reasoning has to survive
Knowledge is preserved when someone can reconstruct why, not just what, without asking anyone. Commit messages count. Decision records count most. A conversation does not count — it is gone.
Frozen surfaces
Some parts of a system are load-bearing and should not change casually. Naming them explicitly forces a written decision before the code, rather than an explanation after it.
Claims are checked against evidence
Every assertion in a document gets a verdict: verified, stale, unsupported, contradicted, or overstated. Counting beats trusting — including when the thing being counted is our own writing.
The full standard, the case-study library and the drift register are internal working documents. This page states the ideas, not the doctrine.
Independent review
Five reviewers who did not do the work
The guardians existed as prompts pasted into the same conversation as the work. That produces a critique authored by the person who just did the thing, holding all the reasons it seemed like a good idea. It is not a second opinion — it is the same opinion, restated.
The fix is structural. Each reviewer runs as a separate agent that reads the change without having lived through the decisions that produced it — which is the only condition under which “why should this exist?” is a real question. And every one of them is read-only, because a reviewer that can fix things stops reviewing and starts implementing, and the finding disappears into the fix without ever being stated.
Architecture
Is this the right shape, ignoring how much work it was? Will it still make sense in five years?
Scope
Watches for quiet growth — adjacent improvements, abstractions for a second caller that does not exist, refactors smuggled into a fix.
Devil's advocate
Argues against, and has to cite file and line to do it. A verdict of survives, but name the bet is a legitimate outcome.
Continuity
Could another engineer pick this up in six months? Was the reasoning preserved anywhere it will still exist?
Claim verifier
Assertions against evidence, one verdict each. It counts rather than trusts.
The clause that makes it work
Four of the five are explicitly told not to invent findings — because a model asked to review will produce findings, since producing findings looks like working. Permission to find nothing is a design response to a behavior someone watched happen.
The reusable layer
atlas-aes
A reusable engineering-practice layer derived from the Atlas Engineering Standard. The method existed first as documents and habits; atlas-aes is the part that travels — installed into an agent session so the discipline arrives with the tooling instead of depending on whoever remembered it.
Hooks
Advisory checks that fire at the moments that matter: before an edit touches a frozen surface, before a commit, after a document is written, and at the end of a session. They advise; they do not block.
Review agents
The five independent reviewers, packaged so they can be invoked against a change rather than pasted into the conversation that produced it.
Commands
The routine work of the method — recording a decision, checking claims against evidence, producing a handoff — as things you run instead of things you remember.
atlas-aes is loaded in live agent sessions with hooks firing, and it has already caught real defects — including one recorded in the public commit history as “the claim checker failed its own check.” What it has not yet done is run in a second repository, which is the test that would prove portability rather than assume it. It is reported here at the rung the evidence supports and no higher, because taking the rung early would refute the standard itself. ACTIVE DEVELOPMENT Where this is going
It doesn't make your AI smarter. It makes it harder for your AI to bullshit you.
That is the whole pitch for atlas-aes, and it is the reason we intend to release it publicly and free rather than sell it.
Anyone using coding agents seriously runs into the same wall: the output is fast, plausible, and unverifiable at the speed it arrives. AES is what we built to stay able to check it. It is more useful to us as a front door than as a product — if the discipline is any good, the systems built under it are the thing worth paying for.
atlas-aes is not published, not on a marketplace, and not installable by anyone outside Knowlton today. It is stated here as intent so that it can be held to. If you work with coding agents and would actually install this, say so — knowing whether anybody wants it is worth more right now than shipping it to nobody. PLANNED Proof
The method is measured by what it caught
It publishes its own misses
The standard measures its own uptake and reports the rows that are never used alongside the ones that are indispensable. A method that only reports its successes is marketing.
It was audited for cheating
The methodology was tested against six specific ways it could have produced flattering results, and the audit is part of the record rather than an appendix to it.
The case studies are failures
A real number bound to the wrong concept. A fix that over-corrected. Two machines sharing one identifier. Each written up because the failure is the transferable part.
It is applied to this website
Every claim on this site is registered with what it rests on, and corrections are recorded rather than quietly edited. The evidence discipline you are reading about is the one that produced the page you are reading.
Limits
Stated, because the method requires it
- Nothing blocks. Every hook is advisory by design. The standard is enforced by cooperation, not by the harness — an agent that ignores the advice proceeds unimpeded.
- Claim checking finds candidates, not truths. It flags language patterns and adjudicates nothing, and it says so in its own output.
- Portability is unverified. The layer has been exercised where it lives, which is the least meaningful test available.
- Adoption across the estate is uneven, and this page will not average it. It is applied deeply in Atlas, genuinely in Kilo and GAIL, and newly in the publishing line.
Commercial position
We are not selling the standard
AES is not for sale and this page carries no offer. Its commercial value is indirect and substantial: it is the reason a technical reader believes the other four pages. For an operation directing AI agents to build real systems, demonstrable verification discipline is the difference between “built four systems” reading as a claim and reading as a fact.
It exists because directing AI agents to write code makes verification the whole job, and we needed a way to know what was actually true. If it is useful to you, take the ideas.