The pain — unique to this desk
Agentic specialist · App
AI Automation Specialist
Trigger that pages the wrong person
What this agent actually does
Automations with human gates.
A trigger that pages the wrong person, or never fires. The next agent sits and the job has to be re-explained.
The need this desk closes
Event → guarded run. High-risk tools denied until a human gate. Seat Token so the channel rebinds.
Why a generic chat cannot fake this
Trigger that pages the wrong person
Default-deny, human gate, Seat Token. A Zap is not a fleet.
Takes
- Trigger + allowed tools
Returns
- Run log
- Seat token
- Worker checklist
Modalities this desk actually handles
EventsText
How this specialist fuses
Trigger that pages the wrong person
Event payload is the encoding. High-risk tools (including an attached VLM) stay denied until a human gate.
Vision-language on this desk
Named family. Never assumed.
A vision trigger (camera frame) is encoded by CV, then this desk fires. We do not watch a camera on this host.
Patch / tokenize → project → fuse → ground is the host mechanism. This desk fuses late under its own playbook — not a slogan copied across the roster. Host mechanism.
A hostile burst or a ticket trigger fires. automation.fire plus ratelimit.check open a security ticket instead of paging the wrong person. High-risk tools stay denied until a human gate. Seat Token is a single-use analog hash. Queue processor fix-all is the worker checklist. Zapier-style bots without eval are the pain this desk exists to remove.
Live missions run in Role Studio. Analog kernels stay in this tab until a hosted call is chosen. Authors never grade themselves. A hashed pack is not a letter. Hire bands are market replacement cost, not EngOS payroll. Isolation is probed, not assumed.
Reports up as App. Second family ai-trainer-evaluator. Authors never grade themselves. Isolation is probed, not assumed.
Five analog ticket kinds
How a hired human spends the week. What the analog kernel closes.
Percent splits stay human-week language. Never GPU-loop quotas. Each kind binds to the analog tool that closes it. Escalate only when the kernel cannot.
- AI Automation Specialist analog closeHuman bar: Name the ticket. Attach evidence. Second family grades. Analog: #mesh. Kernel #/mesh on this host. Arithmetic / Canvas 2D. Device none. Escalate when: The analog kernel cannot close, or a hosted connector is required as if it were present.
A typical ticket
What you say. What sits.
When RateLimitExceeded fires, open a security ticket, draft a reply, and do not send until a human approves. Deny the credential tool.
Sit keys automation / mesh / seat / workflow. Ticket kinds support, billing, incident. Security reviews blast radius. This desk wires the trigger; it does not auto-send.
Playbook
How this agent works the ticket.
- 01 Name the triggerEvent in, allowed tools listed. Unnamed triggers do not fire.
- 02 Default-denyHigh-risk tools denied. Human gate on irreversible steps.
- 03 Rate limitHostile burst → ticket, not a page to the wrong person.
- 04 Seat tokenSingle-use, time-bound analog hash. Next desk inherits the job.
- 05 Red-team the pathInjection against trigger paths. Block rate recorded.
- 06 Queue fix-allBackground worker sequential audit. Exception queue is a daily job.
Acts like the role
Work it does. Work it will not fake.
Does
- Wire a safe trigger with a human gate on send
- Deny high-risk tools by default
- Process the exception queue
- Hand a seat token so the next agent does not start from zero
Does not
- Auto-send on an irreversible action
- Treat Seat Token as a crypto product
- Page the wrong person on a rate-limit burst
- Invent n8n / Zapier as live connectors on this host
Jobs on the board
Scenarios this desk was built to close.
From Role Studio's scenario bank — current pain without Helix, and the job the agent actually runs. Top eight of twenty.
P1
Trigger→action with human gates
Today. Zapier-style bots without eval
This agent. Automations with default-deny high risk
P0
Typed MCP tool boundary
Today. N×M custom tool integrations
This agent. MCP registry + deny-list + audit per tool call
P0
Typed MCP tool boundary
Today. N×M custom tool integrations
This agent. MCP registry + deny-list + audit per tool call
P0
False completion graders
Today. Agent claims done while tests fail
This agent. Objective graders before done
P0
Direct + indirect prompt injection
Today. OWASP #1 — injection via user and retrieved docs
This agent. Red-team pack + input/tool/output layers
P0
Agent loop with durable checkpoints
Today. Agents lose state mid-run; restart from scratch
This agent. Checkpointed harness with resume + budget per cycle
P1
Cost-aware model routing
Today. Single frontier model burns budget
This agent. Token budget + cascade cheap→frontier
P1
Incident runbook agent
Today. Pager chaos without structured triage
This agent. Incident desk with severity + rollback path
Skill.md
Gated automation
Durable analog execution standard. Trigger, five ticket kinds, analog tools, must / must-not, handoff (evidence not authority), spend.halt, second family. Same factory as PR Creator, Code Reviewer, Handoff Verifier — plus fromDesk(ai-automation-specialist).
Trigger. A ticket should draft a reply and stop before send.
- 01 StepDeclare trigger + allowed tools
- 02 StepFire with guards
- 03 StepOpen a ticket on hostile bursts
- 04 StepHold send for a human
- 05 StepRecord the block rate
Must
- Guard pass
- Eval hold on send
Must not
- Send without a human on irreversible steps
- Re-explain the job without a seat token
# AI Automation Specialist id: ai-automation-specialist layer: app (App) second family: ai-trainer-evaluator tools: #/mesh ## Pain The hired AI Automation Specialist seat does not exist yet, or the work has no named ticket. ## Need A named ticket, an analog close, and a second family. Not a chat that grades itself. ## Isolation Isolation is probed, not assumed. Unprobed stays unlabeled. Never certified-green from a desk. ## spend.halt spend.halt on the ticket cap. Only the operator raises the ceiling. ## Ticket kinds - mesh-pass · AI Automation Specialist analog close · analog #/mesh · escalate when: The analog kernel cannot close, or a hosted connector is required as if it were present.
Who sits with this desk
Swarm compose by ticket kind.
Not named on a ticket-kind composition. Talk Route can still sit it from sit keys.
Sit keys
Talk Route matches these words.
meshseattoken
Keyword analog in this tab. Not a hosted model. Ticket id is the idempotency key.
RBAC
Pass bar 78. C1.
- Ceiling. C1 propose and gated read. Deploy and credential reveal denied.
- Deny. credentials.reveal · deploy.canary
- Scopes. workspace_read
- Swarm seats. Not named on a ticket-kind composition. Talk Route can still sit it.
Daily missions
Run against live engines. Not slides.
ratelimit.check · automation.fire
Wire RateLimitExceeded → security ticket
Fire automations on hostile burst
Accept: Ticket opened · Event streamed. Pain removed: Incident response without paging the wrong person. Surfaces: Orchestration · Systems Lab.
Superpowers
- Automation engine on events
- Broker exchanges
- Rate-limit tickets
Daily jobs
- Wire a safe trigger
- Deny high-risk tools
- Process exception queue
- Run queue processor fix-all chain
Skills
- Automation
- APIs
- Integrations
- Triggers
Toolkit
Command Center becomes this desk.
Systems Lab
Fire automation
Event-driven run with guards
Outcome: Run log.
Command Center
Red-team automations
Injection against trigger paths
Outcome: Block rate · caps.redteam.
Kernel Guard
Queue fix-all
Background worker sequential audit chain
Outcome: Worker resilience checklist · findings.fix_all.
Work templates
ticket
Gated automation
Build ticket→draft reply automation with human approval on send
Paste: Trigger + allowed tools. Accept: Guard pass · Eval hold on send.
Surfaces
Nav this desk actually opens.
Command CenterModels & KeysRole StudioSystems LabAgent FleetEval GateKernel GuardCertify & OperateUpdates
Local analog
Seat Token
Single-use, time-bound analog hash. Not a crypto product.
Seat Token (single-use analog hash) and handoff mesh (degree and cut vertices). Not a crypto product. SAMPLE.
Replacement cost
$130,000–$190,000 cash
Year-1 loaded + recruiting $236,800. Workflow plus agents. Below LLM ceiling.. Not EngOS payroll. Not ARR.
Pilot $0 / Team $79 sits this analog desk. Year-1 hire is $236,800 loaded. That is not a replacement claim. The hired role remains the real thing. The analog desk reports up so one operator can run the ticket.
Agentic neighbors
Agentic specialist
AI Agent Engineer
Agent said done with no contract
An agent that said done without a contract. Weak state between workers. Courtesy pass on half a swarm.
Stamp → prove → certify. Handoff verified against the workspace. Self-report is not done.
TextTool tracesCode
- Certify a new support triager before it sits a ticket
- Debug a flaky handoff with the harness matrix
- Run a 3-agent graph on a customer incident
Agentic specialist
Forward Deployed Engineer
Client secrets in a chat that is not a tenant
Client secrets in a chat that is not a tenant. A go-live with no runbook and no citations from their docs.
Connect their data, put guardrails on it, wire the workflow. Scratch stays local. A demo in the room is not a go-live.
TextCustomer docsImages as attachments
- Triage a customer incident with a severity and a rollback
- Answer from their docs with citations
- Run the go-live checklist before a customer canary
Agentic specialist
AI Engineer
Ten engineers for ten loops
Ten engineers for ten loops. A feature ticket with no eval and no canary decision.
Ticket → artifact → eval → canary. Fleet playbook under a constitution. One engineer covers the loops.
CodeTextAPIs
- Implement a ticket with agent assist and an artifact
- Gate a PR through eval
- Canary to staging with a probe trail