One trusted agent over the others. It holds work back and asks. It never approves.
A studio has many agents, each doing one job: one writes the brief, another plans the work, others review it and a coding agent writes the code. Without one role watching them, what passes between them and what they hand back is not checked from start to finish. The Studio Controller is that role: it briefs the coding agent, checks each answer the other agents give, oversees the Fully Autonomous loop and holds syncs with the people who run the studio.
It has no authority of its own. A person, or the owner's standing approval, decides every gate; the reviewer agents judge the Definition of Done; GitHub or a person merges.
Six jobs, each on the studio's own AI keys and each counted against the limits you set.
After each stage of an Auto Pilot run it judges what the stage’s agent made against the task, the intent and your definitions of ready and done. A rejection of the brief, the value or the work items asks the agent once more with its reasons; what is still wrong is left for a person.
On a work package it composes the block at the head of the coding agent’s brief: what matters most, how the result will be judged, what to watch for, what not to change, and what to ask rather than guess.
It logs why each intent was taken, in fixed words from the facts the loop ordered on, and a holding verdict keeps a package from the loop’s approval until a person looks.
A short report a person can answer: what happened, what it decided and why, what it assumed, what does not add up, what it needs you to decide, how the agents did, and whether the direction is still right.
Short notes from its checks and syncs, and notes you add. The owner reads, edits, pins and retires them, and they reach its prompts as notes, never as instructions.
When the pull request is up, Ask the Studio Controller says of each ask whether it is evident, not evident or contradicted in the change. What is not met is offered to the rework as guidance, never as a verdict.
The eight phases of the AI Delivery Lifecycle, what the Controller does in each, and who still decides.
| Phase | What the Studio Controller does | Who decides |
|---|---|---|
| Intent | In Fully Autonomous mode, logs why the loop took each intent. | The loop orders the intents; a person can reorder or skip them |
| Context | Reads the studio’s intents, definitions of ready and done and its memory, as data. | Nothing changes because it read them |
| Plan | Checks the brief, the workstreams, the work packages and the work items as each Auto Pilot stage ends. | A person, or the owner’s standing approval in Fully Autonomous, approves each package |
| Code | Composes the guidance block at the head of the coding agent’s brief, shown to you in full first. | Whoever starts the run chooses to send it or not |
| Review | Reads the pull request against what it asked, when you ask it to. | The reviewer agents and a person judge the Definition of Done; GitHub or a person merges |
| Verify | No part: verification is the reviewer agents’ and your own CI’s. | Unchanged |
| Release | No part. | The two-key sign-off, automation and a named person |
| Telemetry | Each sync carries a snapshot of how the agents did: calls, spend and verdicts. | People decide what to change |
Every check ends in one of five verdicts, each a row on the run's review list in words, never a score.
The agent did what it was asked. The run carries on.
The agent could not do all of it and said honestly why. The run carries on, with the reason on its review list.
Something only a person can decide. It is put to you on the run’s review list and, in Fully Autonomous mode, holds the package from the loop’s approval.
The agent did not do what was asked. For the brief, the value and the work items the Controller asks it once more with its reasons; what is still wrong after that is left for a person, and in Fully Autonomous mode holds the package.
The Controller could not give one. The stage is left for a person rather than passed, and in Fully Autonomous mode holds the package.
The Controller works in every mode. What it can hold back follows what the mode leaves to a person.
| What | Supervised | Semi-Autonomous | Fully Autonomous |
|---|---|---|---|
| Checks each Auto Pilot stage | No Auto Pilot runs in this mode | Yes, every run | Yes, every run |
| A holding verdict keeps a package from approval | A person approves every package anyway | A person approves every package anyway | Yes: the loop’s approval waits for a person |
| Syncs | When an owner or a reviewer asks | When an owner or a reviewer asks | When asked, and by itself every few runs or days, or when something needs you |
| The loop’s decision log | No loop | No loop | Why each intent was taken |
| The coding agent’s guidance block | Composed when you ask, before you start a run | Composed when you ask, before you start a run | Composed for each package the loop sends to coding |
| Its memory | Kept and managed by the owner | Kept and managed by the owner | Kept and managed by the owner |
Semi-Autonomous and Fully Autonomous are part of the Business and Enterprise plans; the Studio Controller is part of Enterprise. A fifteen-minute watch that wakes a Fully Autonomous loop whose run was lost is built but not yet switched on; until it is, the loop's own wakes carry on as before.
It covers what happened, what the Controller decided and why, what it assumed, what does not add up, what it needs you to decide, how the agents did and whether the direction is still right. Anyone in the studio can answer; what approvers say reaches its next check. At most one opens a day, and the owner can make the Fully Autonomous loop wait for an open sync.
Assumptions, how agents tend to behave, facts about the studio, lessons and the owner's direction, each a short note. The owner adds, edits, pins and retires them. The coding brief is composed only from notes a person wrote or the owner pinned.
The guidance block is shown to you in full before the coding run starts, and you can send without it. It is written into a repository only when GitHub says the repository is private, and it never names the repository's own machinery (workflows, permissions, branch protection) or tells an agent to expose a secret.
Its card sits straight under the operating mode: the switch, a display nickname, the sync cadence, and whether the Fully Autonomous loop waits for an open sync. Only the studio owner changes them.
Beside the trust level at the top of every Studio page: a dot that is filled when it is on, hollow when it is off and dashed when the plan holds it back.
Its status, the open sync with its agenda and summary, its decision log and its memory. An owner or a reviewer asks for a sync there, in any mode.
Its guidance block on the coding form, and Ask the Studio Controller once the pull request is up.
Every call is on the studio's AI keys and counts against the run's limits, the loop's ceiling and the monthly budget: one check a stage, at most one more ask, one summary a sync, one brief block a package, and one call each time you ask it about a pull request. The run's estimate says so before it starts.
How the Controller fits the rest of the Studio's controls is on Agent Pipelines and in the documentation.
