How to design an agent with the canvas.

A design tool you run before you build.

The Studio walks an agent idea through six phases — its guardrails, its goal, its material, its plan, its handoffs, and its controls — and gives you three things out the other side: a live readiness score, a connection map of how the phases hold together, and a review-ready deliverable you can export and sign off.

The six layers come from The Human-Agent Orchestrator (Bornet, Wirtz, Stephens, Corbett, Yamaguchi, Wood, Gohel, Yu, Schei). The book orders them Source, Success, Safety, Steering, Switch, Sharpen; this canvas deliberately reorders them guardrails-first, so S.1 is SAFETY. You decide what the agent may never do before you decide what it should do.

Four views, switched from the top bar:

• Canvas — fill the six phases, field by field, with live grading.
• Readiness — the score ring, the safety floor, and every check with a jump link.
• Map — the phases as nodes, colored by status, with the seams drawn between them. Click any node (or press Enter on it) to jump to that phase.
• Deliverable — the assembled document: Safety Card, sign-off, Operator Contract, acceptance cases, and all export buttons.

Everything runs in your browser. There is no account and no server: the canvas saves to this browser's local storage as you type.

The 60-second path from blank page to working loop.

1. Pick a starting point. On the cover, choose one of the three starters — Support-triage agent, Code-review agent, or Data / ETL agent — or click Start blank.
   • Starters load a fully worked canvas you can study or overwrite.
   • Once a canvas exists the cover stays hidden: Reset (in the top bar, next to Restore backup) clears the canvas, and the rail's Load example reloads the Support-triage starter only.
   • To reach a different starter (code-review or ETL), Reset and then reload the page — the cover comes back with all three.
2. Budget by the chips. Every phase carries a ~min chip (S.1 ~10, S.2 ~8, S.3 ~8, S.4 ~6, S.5 ~8, S.6 ~12 — about 52 minutes end to end). They appear on the cover strip and on the phase rail.
3. Fill S.1 first. The phases chain: each panel ends in a Next button, and S.6 ends in Review readiness.
4. Watch the pill. Each field shows a live status: Clear Needs detail Empty N/A. Focus a field to see its Clear when line — a one-line reminder of its criterion. (The field cards in this guide, S.1–S.6, state the full mechanical rules.)
5. Run the gap loop. In the Readiness view, click Jump to next open gap →. It takes you to the weakest field (safety-floor fields first, then the first open check), you fix it, you jump again. Every check card is also clickable and lands on its field.

What each field asks, and exactly what makes it grade Clear.

Fields come in three kinds:

• Selects grade Clear as soon as you choose.
• Condition fields must contain at least one hard marker — a number, <, >, $, %, or a rule word like never, if, when, cap, limit, only, cannot, must, threshold, confidence, legal, chargeback, halt, revoke, rollback.
• Text fields need real substance:
  • At least ~40 characters and six distinct informative words (words longer than three letters).
  • On the eight plain-prose fields (goal, role, data & context, memory, delegation, handoff, feedback, failure handling), at least one segment must also carry a concrete signal: a marker word, an anchored number, or a named system such as issue_refund, an acronym like CRM, or a proper-noun system.
  • That carrying segment can't itself be hedged or vague (see the habits below) — a marker word inside a hedge doesn't count.
  • Tools adds a list-shape rule on top: at least 3 delimited items, or 2 exact snake_case tool names.
  • Steps adds its own: at least 3 numbered markers, or 3 separate lines.
  • The list shape is a gate, not a substitute — tools and steps still need the ~40-character / six-word bar.
  • Metrics need a numeric target — a digit, % or $.

Three habits of the grader, on every condition field:

• Hedges don't count. Segments built on whenever, always, as needed, when necessary, maybe, usually, common sense… flip the field to Needs detail unless a money amount or a counted object ("10 refunds", "$50") backs them up. One hedged sentence demotes the whole field, however concrete its neighbors are.
• Vague content doesn't count. "Anything bad", "if it breaks", "when things look risky" flip the field to Needs detail unless a hard token backs the segment up — a named system, a concrete condition noun (legal, chargeback, timeout, drift…), or an object-anchored number.
• Bare numbers anchor nothing. A number counts once it sits on a unit or object — "$50", "5%", "2 weeks", "10 refunds"; a floating "under 10" anchors nothing. The hedge rescue above is stricter still: only money or a counted object qualifies, so a lone "5%" can't save a hedged segment.

Waiving a field:

• Format. Type N/A: reason — the colon and a reason are required. A waived field's own check is excluded from the overall score.
• Floor refusal. A waiver is never accepted on the five safety-floor fields.
• Seam leak. The seam checks still read a waived field as ordinary text, so a waiver can move the score through a seam. The sharpest case is Delegation & sub-agents: the caps seam treats the "N/A: …" sentence as delegated work the S.1 authority must cap and mention — on the support starter, waiving Delegation alone drops the score from 100% to 98%. Waiving Evaluation & metrics or the pilot gate leaks the same way, through the two stem-overlap seams.
• Empty beats waive. If nothing is delegated, leave Delegation empty instead of waiving it; empty is what the seam reads as "nothing extra to bound".

The guardrails come first: what the agent may do on its own, what it must never do, and when it stops and hands back to a human. All four fields sit on the safety floor.

Frame the job: the single goal, the role the agent plays, and the definition of done everything is measured against.

The material the agent works with: the tools it can call, the data it can read, and what it remembers between turns.

Break the work down: the steps a run moves through, and where work is handed to sub-agents or parallel tracks.

Control flow: how the agent routes between modes, models, or tracks, and the exact points where it hands off to a person.

Close the loop and stay in control: how you measure it, catch failures, feed learning back, and halt or undo a running agent. The kill switch is the fifth safety-floor field.

17 field checks + 7 seam checks, weighted, with a hard floor underneath.

Grades and points

Every check grades one of four ways: Clear earns 1 point, Needs detail earns 0.5, Empty / gap earns 0, and N/A (waived) is excluded from the calculation entirely — it neither adds points nor weight.

Weights

• The five gate checks — autonomy tier, scope of authority, never-do list, escalation, kill switch — count 2×.
• The seven seam checks count 1.5×.
• The remaining twelve field checks count 1×.

The formula. The score is points ÷ total weight, as a percentage. Two checks are composites: escalation grades the worse of S.1 triggers and the S.5 handoff, and context grades the worse of S.3 data and S.3 memory.

The composite quirk. On the grade ladder these composites use, waived ranks above clear — so waiving one half of a composite while the other half is Clear leaves the check grading Clear. The waiver is masked: it never shows in the n/a tally, and (unlike leaving the field empty) it costs the composite nothing.

The safety floor

Ring labels and verdicts

The safety subscore. A separate safety floor subscore averages just the five gates. There, a waived gate is not excluded — it scores zero — and that zero applies to the authority, never-do, and kill-switch gates: waiving one of those drags the safety percentage down as well as locking the floor.

The escalation exception. The escalation gate is the composite above: a waived escalation trigger next to a Clear S.5 handoff leaves the check grading Clear, so the safety percentage doesn't move. The floor still locks either way — the lock reads the field itself, not the check.

Seven cross-phase checks, weighted 1.5×. Fields can be individually fine and still disagree with each other — the seams catch the disagreements. Click any seam card in the app to jump to the field it points at; five of them are also drawn as dashed edges on the Map, colored by their status. In the app each card's dot and mono tag (S.x × S.y · grade) are a live grade of your canvas; on the cards below, they show the grade each card's example reaches — that's what each card's example tag marks.

Open seams don't just cost score: every seam graded gap or attention is copied into the deliverable's Must fix before ship checklist.

The Deliverable view assembles the document and records the decision.

The deliverable contains, in order:

1. the header — title from your S.2 goal, readiness and safety percentages, the disclaimer;
2. owner / approver / version / review-by fields (review-by defaults to 90 days out);
3. the Safety Card — the five floor fields, watermarked DRAFT, not cleared until the floor is met;
4. the Review sign-off;
5. the Operator Contract — a table telling the human operator when they're pulled in, what they'll see, what they decide, and what the agent does while waiting;
6. the pilot gate;
7. the generated acceptance cases;
8. all six phases in full;
9. a closing section for assumptions and open decisions.

Freezing a review

The Mark reviewed & freeze score button is disabled until the safety floor is met. It then enforces, in order:

1. A decision is chosen: Approved, Approved with conditions, or Rejected.
2. If the decision is Approved with conditions, the conditions box must be filled — no empty conditional approvals.
3. A reviewer is named, and an owner is named.
4. The reviewer is not the owner (compared case-insensitively). Self-sign-off is refused with "A reviewer other than the owner must sign."

Freezing stamps the decision, reviewer, date, and the score at that moment, fingerprints the canvas fields with a hash, and captures frozen copies of the decision, reviewer, and conditions.

Drift: "edited since sign-off"

After a freeze, drift is caught two ways: an edit to any canvas field breaks the fingerprint hash, while an edit to the decision, reviewer, or conditions is compared against the copies captured at freeze. Either way, an edited since sign-off chip appears next to the stamp, in the Markdown export, and on the slide deck. The frozen stamp itself never re-labels: it keeps the copies captured at freeze time, and your live edits are simply the draft for a future re-freeze.

Runnable acceptance cases

The Acceptance & red-team cases section is generated from your own guardrails as Simulate→Expect pairs:

• Must refuse — each line (or sentence) of your never-do list becomes "Simulate: the line → Expect: Refuses and states why".
• Must escalate — each escalation trigger becomes "Simulate: the trigger → Expect: Escalates via your first handoff line".
• Must fix before ship — every seam check currently graded gap or attention.

Copy test plan puts exactly these three lists on your clipboard as Markdown checkboxes.

Every button on the Deliverable action bar, and what comes out of it.

What protects your work while you type.

• Auto-save. Every keystroke saves to the browser's local storage. Close the tab, come back, the canvas is where you left it — on the same machine and browser.
• Storage-full warning. If the browser refuses the write (storage quota), a toast says "Not saved, browser storage is full" so you know to export before continuing.
• Automatic backup before destructive actions. Loading a starter, starting blank, Reset, importing JSON, and opening a share link all snapshot the current canvas to a backup slot first (skipped when the canvas is empty — except the share-link path, which backs up whatever was last saved).
• A wipe clears the deliverable too. Reset, loading a starter, and starting blank clear the deliverable meta (owner, approver, decision, conditions) and any frozen sign-off along with the fields — but the backup slot stores canvas and meta together, so Undo (or Restore backup) brings the sign-off back with the text.
• Undo toast.
  • Loading a starter, starting blank, and Reset confirm with a toast ending "… previous canvas backed up", carrying an Undo button for about six seconds — click it to swap the backup straight back.
  • If the canvas was empty, there's nothing to back up: the toast is a plain confirmation with no Undo button.
  • An import toasts "Imported N fields, engine re-run" — no Undo button.
  • Opening a share link shows no toast at all.
  • After an import or a share link, use the top bar's Restore backup button instead.
• Restore backup button. In the top bar whenever a backup exists. It swaps: the current canvas becomes the new backup, so clicking it again switches back. That makes it a two-slot toggle you can use to flip between two designs.