What is the failure mode of an agent that is too autonomous, and one that is too cautious?

Corda Bottling Co fills about 120,000 bottles a day across three lines. A vision agent watches every bottle's label and fill level and can quarantine a pallet, or push for a full line halt, on its own. Baris Yildiz has led quality at Corda for nine years, and works from a wall-mounted terminal beside the packaging line that shows the camera feed.

How to answer this, stage by stage

Nobody's grading whether you can define "autonomy." They're grading whether you can show both failure modes land in the same place, for opposite reasons.

Let's learn

Before the agent, Corda's quality techs pulled one bottle in every 200 off the line by hand, about 600 bottles a day, 20 seconds each, roughly three and a half hours of hands-on checking, catching maybe 70% of real defects since most bottles never got looked at.

Corda's vision agent inspects every single bottle's label and fill level through a camera, catching an estimated 99.5% of real defects, and can quarantine a pallet of 120 bottles on its own.

Corda tried both ends of the dial before finding the middle. First, full autonomy: zero human confirmation on any quarantine, of any size. It ran clean for three months. Then a label supplier switched to a glossier stock, and the detector's read on "smudge" and "low fill" both quietly drifted, one direction each, in the same week.

What that cost at its worst: two production days shipped with a real fill-level defect before a distributor's own QC caught it, forcing a 40,000-bottle recall.

What I would leave alone: pallet-level quarantines on clearly out-of-range readings. Those stay auto-executed either way; they're cheap, reversible, and rarely wrong.

The lesson: "autonomous" and "careful" aren't opposite ends of a safe line. Both extremes remove the one thing that actually catches drift: someone paying real attention.

Now here is the same thing as a story

The short version above is what you'd say defending this fix to Corda's plant leadership. Read this one for how both failures actually happened.

Baris Yildiz has led quality at Corda Bottling Co for nine years. He can hear a fill-level problem in the sound of a capping machine before a single number changes on a screen.

The same five steps trace both failures in this story, just with a different flip family each time.

For three quiet months after the agent launched with full autonomy, Baris checked its quarantine log every morning. By month two, it was always the same: routine, routine, routine. By month three, he'd stopped opening it at all.

The checking faded slowly. Once it hit zero, there was no gradual way back, only a reason to look again.

The label supplier's glossier stock shipped in on a Tuesday nobody flagged as important. The new glare read as a smudge sometimes, so the detector's smudge threshold got quietly loosened by an unrelated tuning update meant to cut false positives, at the exact same time the fill-level threshold happened to drift the other way.

Nothing dramatic happened at the drift itself. Two shipments went out before anyone had a reason to look back.

Two shipments in a row came back flagged by the distributor's own inbound QC: low fill, same defect, two days apart. That was the whole trigger. No dashboard alarm ever fired, because nothing had crossed the agent's own thresholds.

Four small things happened in the same week. None of them alone would have been a crisis.

Corda's leadership reacted the way most teams do after a recall: they cranked sensitivity up hard and required a human to confirm every single flag, no exceptions. Within two weeks, flags hit 40% of pallets, a volume nobody could review closely and still finish a shift.

The agent's own settings have many positions. A person's attention only ever has two: watching, or not.

Review time per flag fell from a genuine 15 seconds of looking to about 2 seconds of reflexive clicking within that same fortnight. A real fill-level flag came through in that window too, indistinguishable from the flood around it, and got clicked past without a second look.

Neither end of the dial was a real fix. The fix was a specific, calibrated point in between.

Replayed with the calibrated band in place: the same label-stock change happens, the detector's confidence sits in a genuinely uncertain range on maybe 4% of pallets, and each of those gets a real look, at a rate Baris's team can sustain without going numb to it. The fill-level drift gets caught inside a single shift instead of two full days.

We built full autonomy because three clean months made it feel earned. We then overcorrected to confirm-everything because a recall makes caution feel like the only responsible answer. Both times, we changed the dial without asking what rate of attention a real person could actually sustain.

FLIPS, run twice on the same lineNot one story with a moral. Two flips, opposite directions, the same five letters both times.

The recap, one line per letter: find the person is Baris and his morning log check, locate the habit is checking fading to zero or reviewing collapsing to a reflex, identify the flip is over-trust on one side and rote click-through on the other, pinpoint the old decision is one action-size limit for every quarantine, and show the replay is catching the same drift inside one shift instead of two full days.

And if you want to be sure it really works, try it somewhere elseSame two failure modes, a restaurant supply warehouse instead of a bottling line. Completely different product, same shape of trouble.

Marcus Iyer manages purchasing for a restaurant supply distributor whose agent reorders perishable stock automatically based on demand forecasts. Mapped onto FLIPS with a different flip family: under full autonomy, the agent quietly over-ordered a seasonal item for six weeks after a one-time promotional spike looked like a permanent demand shift, a substitution flip where the forecast kept "confirming" itself on stale data nobody rechecked. Under the overcorrected version, every reorder above a token size required manual sign-off, and Marcus's buyers, swamped with dozens of daily approvals, started approving in batches without reading item-level detail, an abandonment flip in disguise, where the approval step still existed but had stopped meaning anything. Both ended in the same place: a walk-in cooler full of product that didn't match real demand.

A different warehouse, a different product, and the same two actions land in the same dangerous corner: hard to undo, and easiest to mistake a spike for a trend.

Swap the trigger and it still runs.
Speed: an interviewer caps you at sixty seconds. Say "both extremes remove the one thing that catches drift: real attention," and stop.
Cost: there's no budget this quarter for a fancy calibration tool. Start by simply capping how much any one action can touch, that alone bounds the damage from either failure mode.
The model gets better, for real: if detection accuracy improves overall, that's still not a reason to drop the review rate to zero. A better average model can still drift on the one input type nobody's tested it against yet.

Where people run it wrong.
They treat "more autonomy" and "more caution" as opposite ends of a safe dial, when both ends remove real attention, just in different directions.
They overcorrect after one incident straight into the other failure mode, without checking what review rate a person can actually sustain.
They measure flag volume instead of review quality, missing the moment reviews turn into reflexive clicks.

How to use it live. When someone asks what breaks at either extreme, don't describe two separate failures. Show that they're the same failure, arrived at from two directions: nobody's actually looking anymore.

Flashcards (tap any card to flip it)

Check yourself Score: 0 / 0