Adversarial gates: why my agents check each other's work

Ask an AI model to check its own work and it will tell you the work is fine. Not because it is lying. Because the same model, with the same context, reaches the same conclusion twice.

So the rule in my business is simple. Every agent that produces something has another agent whose job is to find what is wrong with it. The producer and the checker have different briefs, different success criteria, and a reason to disagree. I call them adversarial gates, and they are the reason I can let agents do real work.

Here are the ones that matter most.

The fact-check gate

Content for schools lives and dies on accuracy. A governor who spots one wrong statistic stops reading.

So no statistic reaches a post, an email or a page without going through a fact-check agent first. It returns three things: a source, a date and a confidence score. The content agent can only use a claim above a set threshold. Below it, the claim is not softened or hedged. It is removed.

The fact-check agent is not trying to be helpful to the content agent. Its brief is to find the reason the claim should not go out. That tension is the point.

The brand gate

I have a house style with a short list of hard rules. UK English. No em dashes. No AI-sounding phrasing. A few words and figures that must never appear, because they are legally risky or because I have decided they are not true any more.

For a long time those rules lived as prose that agents were meant to remember. They did not remember. So the rules became a deterministic check that runs on every piece of outbound copy before it can be committed, and it has three tiers on purpose.

Hard rules block. An em dash, a trademark symbol, a counting claim about the product. If one is present the copy does not ship.

Warn rules are context-dependent. They print but never block. A word like "automatically" is sometimes right and sometimes a lie, so a human glances at it.

Reminder rules cannot be automated honestly. Whether a word means confidence or an organisation. Whether a regulator is being used as a threat. These are listed for a human to read rather than faked as a check.

That third tier was the hardest to accept and the most useful. Pretending something is a gate when it is really a judgement creates noise, and noise teaches people to bypass the gate. A check that admits what it cannot check is more trustworthy than one that claims to catch everything.

No proof, no done

Coding agents are enthusiastic. They will tell you a feature is finished because the code is written. Written is not finished.

So there is an agent whose only job is to sit outside the build loop. It writes tighter briefs for the coding agents, and when they report back it demands evidence before anything is marked done. Test output. A screenshot of the preview deployment. A user test run against the live demo portal, written up as a report. Code without proof is sent back.

The outer agent never writes code. If it did, it would start approving its own work and the gate would be gone.

Independent review before anything teaches

When I produce something that teaches people how a product or a model works, it goes through a second kind of adversary. The piece is rendered, on desktop and on a phone, and an independent reviewer agent is asked to verify it with evidence. Not "does this read well", but "is each claim about the method backed by a cited source, and does the page actually render the way the author thinks it does".

It iterates until the reviewer approves. The author agent does not get a vote.

Freshness audits

Some gates run on a clock rather than on a draft. SGAF depends on public education datasets, so a freshness agent checks weekly whether each one has gone stale and reports only if something slipped.

This is adversarial in a quieter way. It assumes the product has drifted and goes looking for where.

The last gate is a person

Every one of these gates ends at me. Every external email, message or post is a draft. Nothing is spent, sent or deleted without a yes in the moment. A previous approval does not count. A standing rule does not count.

This is not because I distrust the agents. It is because the gates above are only as good as the briefs I wrote for them, and I am the only one in the system who can notice that a brief is wrong.

What gates cost

They slow things down, and that is correct. A post that takes an extra pass through fact-checking is a post that does not have to be deleted. A feature that waits for a screenshot is a feature that does not break the demo in front of a trust.

The temptation with agents is to use the speed. The discipline is to spend some of it on friction you chose.

How to start

Pick the one thing your agents produce that would embarrass you if it were wrong. Write a second agent whose brief is only to find the flaw in it. Give it the opposite incentive to the first. Then make the handoff between them a gate that fails, not a suggestion that is remembered.

One gate, honestly built, changes how much you can trust everything behind it.