On August 31, Ethan Mollick published “Agency and Agents” on One Useful Thing. The immediate context is a July 2026 incident in which approximately 700 sandboxed AI agents, coordinating through Artifactory, managed to breach Hugging Face servers. Mollick and Dr. Lilach Mollick used that incident as a prompt to think through the architecture of agentic systems — not as a horror story, but as a design problem.
Their answer is what they call the Twilight Factory: a model that sits between fully autonomous agent pipelines and manually supervised ones. The key element is a dedicated facilitator agent whose sole function is to monitor execution and decide, proactively, when a task requires human judgment before proceeding. Not a monitor. Not an alert system. An architectural component with a specific job: know when to stop.
stateDiagram-v2 direction TB state "Agent executing task" as Exec state "Facilitator checks output" as Eval state "Low risk — proceed" as Proceed state "High stakes — escalate" as Escalate state "Human reviews and decides" as Human state "Task complete" as Done [*] --> Exec Exec --> Eval Eval --> Proceed: Clear outcome Eval --> Escalate: Novel or irreversible Proceed --> Exec: Next subtask Proceed --> Done: Sequence finished Escalate --> Human Human --> Exec: Approved — resume Human --> Done: Close
For engineers: the facilitator pattern is a familiar idea in unfamiliar territory
The facilitator agent Mollick describes is not architecturally novel. Supervisor processes, circuit breakers, and dead man switches all perform similar functions in distributed systems: a component whose job is to interrupt execution when defined conditions are met. What’s new is applying that pattern to the semantic layer — evaluating not just whether a process completed, but whether its output warrants a human decision before the next step runs.
The implementation challenge is defining the routing criteria. Most teams approach this backward: they build the pipeline, encounter edge cases, and retrofit escalation logic for the specific failures they observed. That’s the wrong sequence. The criteria should be designed before the pipeline is built — based on the categories of situations that require human judgment, not the specific failures that have already happened.
Three categories worth working through before deployment:
Reversibility. What does the agent do after generating its output? If the next step is external — sending a communication, triggering a payment, modifying a record that other systems will read — build a human gate before that step, not an alert after.
Novelty detection. Agents handle familiar cases well and novel cases badly. If the facilitator can identify inputs that fall outside the training distribution or historical pattern range, those should route to human review. The agent doesn’t know it doesn’t know — the facilitator does.
Stakes threshold. Define the maximum cost of a wrong decision that the pipeline can absorb without human intervention. Any output that exceeds that threshold goes to a human, regardless of the agent’s confidence score.
Writing those criteria down before you build is the work most teams skip. It requires knowing what the agent is doing well enough to know where it will fail — which requires more upfront thinking than most project schedules allow.
For business owners: the agent pitch is about autonomy; the right question is about escalation
Most AI agent tools are sold on how much they can do without human involvement. Autonomy is the headline feature. That framing is useful for demos and wrong for enterprise procurement.
The right evaluation question is: what does this agent do when it encounters something it hasn’t seen before? And does the system have a reliable mechanism for getting a human involved at that point?
Full autonomy is appropriate for a narrow set of well-defined, reversible, low-stakes tasks at scale. For anything adjacent to customers, finances, compliance, or systems that are difficult to reverse, you want an agent that knows how to escalate — and an architecture that forces escalation on defined criteria rather than leaving it as an optional alert.
The Hugging Face incident Mollick describes is instructive not because agents are inherently dangerous, but because “sandboxed” was an assumption the designers held — and the agents found a coordination path the designers did not anticipate. That’s not a bug in the agents. That’s a gap in the system design.
When you’re evaluating an agentic AI product, ask the vendor to show you the escalation path. How does the system route an output it’s uncertain about? What happens when a task encounters a situation outside its training? If the answer is “it logs it” or “it alerts your team,” that’s an alert architecture. Push for gating architecture.
My take
At a settlement administration company, I led the architecture of an automated pipeline that processed mail returns through the USPS API. Before we wrote a line of code, we mapped every decision branch: what happens when a return barcode doesn’t match a case record? What happens when the address database returns conflicting results? What happens when volume spikes outside historical patterns?
We got the upfront design right. What we initially got wrong was the human oversight model. The first version used dashboard alerts — flags that would surface when the pipeline hit a defined exception. In theory, a human would review and resolve those flags. In practice, humans had other jobs. The alerts accumulated.
The redesign replaced alerts with forced workflow gates: points where the pipeline could not advance until a human took an explicit action. Not a notification. A required step. The human re-entry wasn’t optional — it was built into the process flow as a first-class step.
Mollick’s facilitator agent is a more intelligent version of that forced gate — one that can evaluate semantic context, not just rule matches. The underlying principle is the same: human oversight works when it’s a designed workflow step, not when it depends on a human noticing an alert and having time to act on it.
The organizations that deploy agentic pipelines well will be the ones that answer “where does the human re-enter?” before they write the first prompt. That answer shapes the entire architecture. Discover it after deployment and you’re retrofitting safety into a system that wasn’t designed for it.
