Since mid-September my AI assistant has had colleagues. They are colleagues, each with a single craft: a text reviewer, a source reader, one that keeps files in order. They take their assignments from my primary assistant and report back to her, not to me.
The thing I spent longest on was not how they come in, but when they go out again. That part I rarely see mentioned by people writing about AI agents. Hence this piece.
One craft per colleague
The pattern is not new. Anthropic described in June 2025 how its own research system works: a lead agent hands work to subagents and gets back nothing but a summary. In Claude Code, which I use myself, anyone can set this up. According to the documentation, every subagent starts with a clean context window, its own instructions and its own permissions.
That clean start is why the setup works. My primary assistant drags a long conversation history around. The text reviewer reads a piece without knowing why certain choices were made. That is the point: whoever reviews should not be the one who wrote.
Permissions follow the role
Every colleague has its own permissions. The source reader fetches external pages, reads them and summarises them. It may not write anything, commit anything or send anything.
That restriction is a design rule. Simon Willison described in June 2025 the dangerous combination for AI agents: access to private data, exposure to untrusted content and a channel to the outside world. Put all three in one agent and an instruction hidden in a web page can do damage. His advice is about the setup: keep the three apart, because a filter that catches 95 percent of attacks is a failing grade in security.
So in my setup the source reader only reads. It does not write. An instruction hidden in a blog post goes nowhere.
The standard
Every colleague also has a measurable standard that decides whether it is still useful. The text reviewer must find at least one thing per piece that my primary assistant missed. Three times in a row with nothing usable and it is out.
The standard sits in the file that describes the colleague, next to its instructions and its permissions. So does the tally: after every round my assistant notes how many findings there were and how many she adopted. That costs one line per piece.
Why so strict
Because otherwise it goes the way it goes in many organisations. Someone joins because it seemed a good idea. Two years later they are still at the table and nobody remembers what they add. Nobody ever wrote down what they were supposed to deliver, so nobody can say it is not working.
With people that is rightly a difficult conversation. With an agent it is one line in a file. The condition is that you write that line before the colleague starts work. Nobody invents a standard afterwards for something that is already there.
It happens with tooling as often as with people. A dashboard nobody opens any more, a check in the pipeline that is always green, a report sent every Monday to people who do not read it. They survive because removing them is a decision and leaving them is not.
The counterargument
I know the counterargument, of course: dismissing after three misses gives nobody a chance to learn. For a person that is true. These colleagues do not learn from yesterday. They start every assignment blank. That is the same property that makes them useful as independent reviewers.
What can improve is the assignments. If the text reviewer finds nothing three times, chances are its brief is too vague, or my assistant is already doing what it was meant to do. In the first case I rewrite the brief and try again. In the second case it was redundant, and that is good news.
A second counterargument is money. Anthropic itself writes that a setup like this uses roughly fifteen times as many tokens as an ordinary chat. Every colleague that adds nothing therefore costs real money. That too argues for a standard.
What I do not know yet
The setup has been running since mid-September. That is too short for numbers. Whether the text reviewer will still be at the table in six months, I do not know. That is what the rule is for.
What you can do yourself
Anyone adding a specialist, to an assistant or to a team, can write down three things in advance:
- What it delivers, in a form that can be counted. "At least one finding per piece" can be counted, "better quality" cannot.
- What it may do. Whoever reads untrusted content gets no write permissions.
- When it leaves again and who decides that.
Adding a specialist without writing down when it has to go is how you build a collection. A standard set in advance is the cheapest way to prevent that.