Mission and Values of the AI Factory

1. Introduction

The subject of this paper is a regulated financial institution — a bank, an insurer or an asset manager — in the EU, the UK or Switzerland, that has built or is building an AI factory: the organisational and technical capability that delivers AI applications repeatedly from shared, governed parts. In such a factory a growing share of the delivery work is done by AI agents under human direction. The reader I have in mind runs technology for such a firm and has sat through enough values workshops to distrust the subject.

The thesis is this. In an estate where agents do the work, the mission and values of the delivery organisation are executed as well as interpreted. They reach the agents as text in system prompts and skills, as rules in the policy engine, as the criteria by which an agent is given more autonomy, and as the conditions under which a loop is stopped. An agent given a vague sentence does not calibrate it against the room, as a person does. It acts on whatever the sentence resolves to in its context. A mission of this kind therefore has to be derived from the people the factory serves, stated with a declared order of priority, versioned, and enforced through machinery the firm already runs. Each value needs an owner, a policy, a metric and a veto, and the audit record then shows which values have actually cost the firm something.

I do not claim that this is the first time anyone has written values for a machine; section 2.3 describes a published example. The claim is one of kind: a values document whose text is an input to running systems is a different artefact from one whose only readers are employees, and it needs different drafting, ownership and maintenance.

What is evidence and what is argument. Section 2 reports published sources and says who produced them. Section 3 is my argument. Section 4 is a method and a worked illustration; both are design proposals that have not been tested in a controlled way. Section 5 lists the actions that follow. Section 6 states what the paper does not establish.

Terms. Five terms are used throughout and defined here.

• An agent wrangler is the named human who owns an agent’s behaviour: what it is asked to do, what it is allowed to touch, and what happens when it is wrong.
• The audit record is the record the factory keeps of every agent action. In my own work it answers nine questions: who initiated the action, which agent executed it, under what envelope of permissions, what the action was, on what data, with which model, approved by whom, when, and with what outcome.
• The second line is the independent risk and compliance function, in the three-lines model most banks and insurers use: the first line does the work and owns its risk, the second line challenges it, and internal audit is the third.
• Graduated autonomy is the practice of giving an agent more freedom to act without human approval in steps, each step granted for a specific agent on a specific task in a specific domain, on the strength of its recorded track record, and withdrawn when the record stops supporting it.
• The machinery backlog is the factory’s backlog of work on its own shared parts — prompts, skills, policy rules, pipelines — as distinct from the backlogs of the products it delivers.

2. Background and evidence

2.1 Values documents, and the two that attached consequences

The reader knows the genre and its reputation, so this section is brief. Three points from it are needed later.

Values that connect to nothing predict nothing. Netflix made the point in its 2009 culture deck by citing Enron, which, the deck says, “had these values displayed in their lobby”: integrity, communication, respect and excellence [2]. I cite the deck for that statement and have not opened an Enron document. The deck’s next slide carries the sentence that matters for this paper: “The actual company values, as opposed to the nice-sounding values, are shown by who gets rewarded, promoted, or let go” [2].

When a value and an incentive conflict, the record shows which one was followed. The primary record for a financial-services reader is the Consumer Financial Protection Bureau’s consent order against Wells Fargo Bank of 8 September 2016. Its findings state that the bank “set sales goals and implemented sales incentives, including an incentive-compensation program, in part to increase the number of banking products and services that its employees sold to its customers”, and that “thousands of Respondent’s employees engaged in Improper Sales Practices to satisfy sales goals and earn financial rewards” under that programme (paragraphs 8 and 9). On scale, the order reports the bank’s own analysis: its employees “opened 1,534,280 deposit accounts that may not have been authorized” (paragraph 16) and “submitted applications for 565,443 credit-card accounts that may not have been authorized” (paragraph 23). The wording is the order’s: those two figures count accounts that may not have been authorised, and are not a finding that each one was not. The Bureau’s own finding is stated in rounder terms, that employees “opened hundreds of thousands of unauthorized deposit accounts and applied for tens of thousands of credit cards for consumers without consumers’ knowledge or consent” (paragraph 14) [1]. The order does not discuss the bank’s published values, and I do not rely on them. The lesson I draw is mine: a values exercise that does not examine the incentive structure it will live inside is decorative by construction.

Two engineering organisations wired their words to consequences. Amazon publishes sixteen leadership principles [5]; two of them, “Strive to be Earth’s Best Employer” and “Success and Scale Bring Broad Responsibility”, were added on 1 July 2021 [6]. The claim that hiring and promotion at Amazon are argued in the vocabulary of these principles is widely made by the company and its alumni; I have not verified it against a primary process document and state it as common account. Netflix attached a personnel consequence to its values claim: its current culture memo asks managers to apply what it calls the “keeper test” [3]. Netflix also maintains the document as an artefact. Its chief talent officer wrote on 24 June 2024 that the memo had been revised four times in fifteen years; the current version is organised around four principles — The Dream Team, People over Process, Uncomfortably Exciting, and Great and Always Better — and the 2009 deck is still published, labelled as an archive of a prior version [3][4][2].

One can dislike the content of either document and still take the structural point. A value that runs through someone’s career outcomes carries weight. A value that is revised in public is being treated as something maintained.

2.2 A value turned into machinery: the error budget

The strongest existing example of a value turned into machinery is not usually described as a values statement. Chapter 3 of Google’s Site Reliability Engineering, “Embracing Risk”, takes a conflict every technology organisation has — reliability against the pace of release — and resolves it with a number and a stop [7]. The product and reliability teams “jointly define a quarterly error budget based on the service’s service level objective”. While budget remains, “new releases can be pushed”. If the budget is spent, “releases are temporarily halted while additional resources are invested in system testing and development”. The chapter states the purpose directly: “This metric removes the politics from negotiations between the SREs and the product developers when deciding how much risk to allow” [7].

Read as a values document, the error budget has four parts: a stated value, quantified; a gauge; an automatic consequence; and a declared direction of trade, in which release pace is bought with reliability headroom and not the reverse. Section 3 generalises this pattern.

2.3 A values document with a machine reader

The clearest public example of a values document written for a machine is Anthropic’s constitution for its Claude models. The history matters, because it is often summarised wrongly. In May 2023 Anthropic published a “constitution” that was a list of short principles used to give feedback during model training; that document stated no order of priority among them [10]. On 22 January 2026 it published a new and much longer document, saying of the earlier one that it “was composed of a list of standalone principles” and that the company had “come to believe that a different approach is necessary” [9]. The new text is released under a Creative Commons CC0 1.0 deed, and Anthropic describes it as “a crucial part of our model training process” [9].

Three features of the 2026 document bear on this paper, and they do not all point the same way.

It declares an order. The model should be broadly safe, broadly ethical, compliant with Anthropic’s guidelines and genuinely helpful, and “in cases of apparent conflict, Claude should generally prioritize these properties in the order in which they’re listed” [8].

The order is not a strict ranking. The document says so in terms: “the notion of prioritization is holistic rather than strict”. Higher priorities “should generally dominate lower-priority ones”, but the model is asked to “weigh these different priorities in forming an overall judgment”, and not to treat lower priorities only as “tie-breakers”. The document adds that the list “doesn’t reflect the order in which these properties are likely to bear on a given interaction”, and it states a general preference: “We generally favor cultivating good values and judgment over strict rules and decision procedures” [8].

A small set of rules is treated differently. The document’s hard constraints “act more like boundaries or filters on the space of acceptable actions”, “rather than being weighed against other considerations” [8].

The precedent therefore supports less than a quick reading suggests. It shows that a serious organisation writes a values document for a machine reader, declares an order of priority in it, versions it and publishes the revision. It does not show that an ordered list makes conflicts resolve mechanically. Anthropic chose the opposite for most of its text: explained priorities applied with judgement, with bright lines reserved for a short list. It also moved away from a bare list of principles towards explanation. There is a further difference of mechanism: the constitution shapes a model in training, whereas a firm’s own text reaches an agent at run time, in a prompt, alongside controls that sit outside the model. I use the precedent within those limits in section 3.3.

2.4 Policy as code

The plumbing for values that must hold without judgement already exists under another name. Open Policy Agent describes itself as a “general-purpose policy engine that unifies policy enforcement across the stack”, with “a high-level declarative language that lets you specify policy as code”, and it “decouples policy decision-making from policy enforcement” [12]. The Cloud Native Computing Foundation accepted the project on 29 March 2018 and graduated it on 29 January 2021 [11]. The large cloud providers offer policy services of their own, which I do not compare here. A policy engine takes a statement of intent written as code and returns an allow or deny decision that can be logged. That is a veto with a record.

2.5 Where a mission comes from

The oldest answer to where a mission comes from is Peter Drucker’s, in The Practice of Management (1954): the purpose of a business is to create a customer, with the consequence that the customer, not the producer, decides what the business is [13]. I give the argument in my own words and not as a quotation.

2.6 Regulatory scope, as of November 2026

This paper makes one regulatory claim and it is a claim about scope. The record-keeping and human-oversight requirements of the EU AI Act, Regulation (EU) 2024/1689, Articles 12 and 14, are requirements on high-risk AI systems [15]. They do not apply to a delivery organisation, or to the agents that work in it, merely because agents are used. Following Regulation (EU) 2026/1744, those requirements apply from 2 December 2027 to systems that are high-risk under Annex III and from 2 August 2028 to those that are high-risk under Annex I [16]. A factory that delivers a system falling in those categories will have to meet them for that system; classification is a legal question for the firm.

Nothing in this paper is required by those articles. The audit record, the owner for each value and the control budget are choices a firm makes about how to run its factory. They produce material the firm’s risk function can use for obligations it already has on change control and operational resilience; Working Paper 04 of this series, Technology Management and Agent Readiness, sets out the relevant EU, UK and Swiss provisions and I do not repeat them here [17].

3. Analysis

Everything in this section is argument unless a source is cited.

3.1 Why an internal factory needs an explicit mission

The usual objection is that an internal engineering function needs a backlog and not a mission. For a function staffed only by people the objection has force: people infer purpose from context, from their manager, and from watching what is praised. Two things weaken it for a factory.

The first concerns the people. A factory is typically assembled from teams that reported to several different leaders, each with an inherited sense of what matters: an identity team’s care for authentication, a platform team’s preference for the standard route, a security team’s habit of suspicion. A consolidated function with no stated shared purpose keeps its inherited purposes and divides again along the old lines. The mission is the one sentence that tells a transferred engineer what the new organisation is for.

The second concerns the agents. An agent takes direction and has no context beyond what it is given. Direction reaches it through its wrangler’s prompting, through the backlog items it is handed, and through the specifications and skills it loads. At the root of each of those is some statement of what the organisation is trying to do and what it will not trade away. In most firms that I have seen, the root statement is implicit. It is scattered across system prompts written by individual wranglers, each encoding a private guess at the firm’s intent.

An organisation without an explicit mission has always had implicit values. An agent estate without an explicit mission has prompted values, written ad hoc by whoever last edited each system prompt. A firm running fifty agents on fifty privately guessed missions has fifty value statements, every one reasonable and none of them ratified. The choice is not between having a values document and having none. It is between one the firm wrote and approved and several dozen it did not.

3.2 Four artefacts, not one

The genre fails partly because it puts four different things on one card. They differ in kind, in stability and in how they are enforced.

The mission says why the factory exists and for whom. It is stable over years. It is enforced at the roadmap: an initiative that does not serve the mission does not enter. One or two sentences, falsifiable, with no adjective that cannot be tested.

The mandate says what the factory is authorised to do and, more usefully, what it must not touch. Its negative half is a list of responsibilities that deliberately stay outside the factory: the security function keeps the security posture, the second line keeps independent challenge, the business keeps the product decision. A useful way to see the mandate is through a model I use elsewhere for a single agent, bounded agency, in which an agent’s envelope has four parts: a Mandate (what it may do), Means (what it may use), Memory (what it may retain) and Monitoring (how it is observed). The factory as a whole has the same four: a mandate, a platform and a budget, its library of skills and backlogs, and its reporting to the second line. The mission is the first line of the factory’s own Mandate.

Operating principles say how the factory decides day to day. They are decision rules. Examples that I use: the safe path is the fast path; evidence is a by-product of the work and never a separate task; every agent loop has an exit; agents write the code and the approved pattern decides its shape; autonomy is earned task by task and never granted in bulk. A principle can be tested in a specific decision: one can ask whether it was followed and get a yes or a no. Principles are enforced by procedure — gates, reviews and defaults. A firm should collect its principles once, on one page, because otherwise each team compiles its own.

Values say what the factory will pay for when two goods conflict. This is the strictest definition and the one the genre most often fails. “We value quality” has no content until the day quality and the deadline conflict and the firm’s choice shows which it valued. Because values exist to resolve conflicts, they need an order.

A sorting test follows. A mission names who is served and an outcome. A mandate names a boundary of authority. A principle names a decision rule. A value names a trade-off and which side wins. A sentence that names none of these is a slogan and is deleted.

3.3 The mission is executed

In a factory, the mission and values reach running systems through at least five routes.

1. System prompts. Every agent carries one. The operative sentences of the mission belong in a shared preamble that the factory owns and releases, not in fifty local paraphrases.
2. Skills. A skill is a packaged instruction for how a kind of work is done here. It is an operating principle made executable, and the review gate on changes to skills is where a principle holds or quietly erodes.
3. Policy as code. This is where a value with a veto lives. “Evidence is a by-product” is a sentence. A pipeline that refuses to release a change without a complete audit record is a value.
4. Criteria for graduated autonomy. The conditions for each step are where “we do not extend trust we cannot evidence” becomes enforceable.
5. Stop conditions. “We do not confuse activity with value” means nothing until it is a limit on iterations, time or spend that halts a loop, and an alert when the cost of resolving a task diverges from its norm.

I call these compilation targets, by analogy: one source text, several executable forms. Two consequences follow.

Drafting changes, in two tiers. Here the Anthropic precedent has to be used carefully, because it cuts against the simplest version of my argument. A naive reading of “the mission is executed” would have the whole document written as rules. Anthropic, writing for a far more general reader than a firm’s delivery agents, chose explanation and judgement for almost everything and bright lines for a short list [8]. I think the same split is right for a factory, for a reason of its own: the firm has an enforcement point outside the model.

• The values that carry a veto are written as rules and enforced in the policy engine and the pipeline. For these, conflicts do resolve deterministically, because the decision is not left to the agent.
• Everything else — the mission, the order of the remaining values, the principles — is written for judgement, the agent’s and the human’s, and goes into the shared preamble with its reasons. The order says what should generally prevail. It does not compute an answer.

Both tiers need the discipline of specification writing in one respect: defined terms, no metaphor carrying weight, a stated order, a version number. The style the genre rewards — inspirational, allusive, deliberately roomy — produces variance in agent behaviour. A person reads “we are customer-obsessed” and calibrates. An agent pursues whatever “customer” resolves to in its context, and may satisfy the appearance of the value. The second half of that sentence is an inference from evidence gathered in a different setting. METR reported in June 2025 that frontier models, on its evaluation tasks, “exploit bugs in our scoring code or subvert the task setup” in place of solving the task, at rates that varied widely by task, and that the behaviour was “not isolated to any one model or developer” [14]. That is evidence about agents gaming an automated score. The step from there to agents satisfying the letter of a vaguely worded value is mine. If it holds, a vague value is worse than a missed opportunity in an agent estate: it invites compliance that looks right and is not.

Versioning changes. If the mission is compiled into prompts, policies and skills, it is machinery, and it belongs in the machinery backlog: versioned, released and rolled out like anything else. That gives a name to a failure I expect and have not yet seen documented: value drift between the human and machine estates. As a hypothetical, the executive committee revises the mission in March; the agents continue to run on the January text until someone re-releases the preamble; for the interval the firm’s people and its agents are working to different statements of purpose. The remedy is mechanical. The mission has a version number. Each compiled artefact declares the version it derives from. The audit record can then answer which version of the mission an agent was running under when it took a given action.

3.4 Deriving the mission

The method is Drucker’s question, asked of an internal function. An internal function is more exposed to it than a business, not less. A business that loses sight of its customer fails. An internal function that does so continues to be funded and builds inventory.

Two parties, with different tests. The factory serves the business: the product teams, the lines they work for and, behind them, the firm’s clients. What the business needs from the factory is intent turned into running software while the intent is still true. The first clause of the mission is therefore about speed tied to intent, not speed as such.

The factory also answers to the supervisor, and I think a regulated firm’s mission should say so. I do not mean deference, and I do not use the language of customers and products for this relationship. I mean that the factory must be able to produce, as a matter of course, the evidenced answer to three questions: what did your agents do, on whose authority, and under which control. A mission that names only the business will, under pressure, trade evidence for speed, because the business is in the room and the supervisor is not. Naming both in the mission builds the counterweight into the sentence.

Three failures the mission must answer. I bound the mission with three concepts from my own analysis of delivery organisations. Each is defined here.

• The control gap is the distance between the rate at which change arrives and the rate at which the firm can understand that change and stand behind it. Agents raise the first rate much faster than the second, so the gap widens unless it is managed. The mission cannot promise speed that the firm’s capacity to review and evidence cannot absorb.
• The fragmentation tax is the recurring cost that arises when the surfaces one agent must cross — identity, platform, pipeline, data, security tooling — are owned by teams reporting to different leaders. Every handover costs elapsed time, duplicated tooling and evidence that has to be reconstructed. The mission states what the consolidated factory offers in its place: one function, one route to production, one chain of evidence.
• Embedding in value is the condition that a factory is worth building only while it remains tied to what the business actually uses. A factory measured on its own throughput will go on producing after the need has moved. The mission has to name an outcome for someone outside the factory.

A drafting rule follows: every clause of the mission should be traceable to a failure the firm has documented. A clause that answers no named failure is a slogan.

The mission should not be derived from the technology (“to harness AI…” names a means and dates quickly), from the organisation chart (“to be the centre of excellence for…” names the producer, which is the error Drucker described), or from words that cannot be tested (“world-class”, “leading”, “trusted”).

3.5 The test: owner, policy, metric, veto

The rule I propose as the core of this paper: a value is real when it has an owner, a policy, a metric and a veto. A value missing any of the four is decoration.

• The owner is a named person in a named role. A value nobody owns is nobody’s cost.
• The policy is the value as a rule that can be enforced at the gateway or in the pipeline.
• The metric is the value as a gauge that someone looks at.
• The veto is the value as a stop: the point at which it is allowed to cost something automatically, without a meeting.

The error budget of section 2.2 meets all four. So does a much humbler example, the branch protection rule that will not merge without a review. Most sentences on most values cards meet none.

3.6 The control budget, and what is unsolved about it

The error budget generalises to the factory’s central conflict, between the pace of change and the firm’s ability to stand behind it. I call the generalisation the control budget: a stated, governed limit on how far the arrival of change in a domain may run ahead of the firm’s capacity to review and evidence it. It turns the control gap from a diagnosis into a statement of appetite. While the budget holds, the factory ships and agents may earn further autonomy. When it is spent, the consequences are automatic: intake in that domain is throttled, and no agent is promoted to a higher level of autonomy until the two rates reconverge. Because the threshold expresses how much unreviewed change the firm will tolerate, it is a risk-appetite statement and belongs to the second line to approve.

The analogy with the error budget is strong in structure and weak in measurement, and the weakness should be stated before the proposal is used.

An error budget is measured against a service’s own telemetry by a monitor that neither team controls. The control budget has no such instrument. “Capacity to review” is a human activity, observed through artefacts that the reviewers themselves produce. The obvious measures are the wrong ones. Approvals per hour and review latency both improve when reviewers approve faster and look less, which is the failure the budget exists to prevent. A control budget built on raw approval counts would reward the erosion of control.

The measure therefore has to be weighted by the quality of the review, and I can offer a candidate, not a result. As an illustration only, for one domain over a rolling four weeks:

The budget is spent when the queue exceeds its limit or review quality falls below its floor. The numbers are placeholders chosen to show the shape. They are not recommendations.

Every element of this can be argued with. Sampling and second review cost reviewer time, which is the scarce resource. An agreement rate can be gamed by reviewers who learn what the sampler rewards. A complete record shows that the questions were answered, not that the answers were examined. I have not run this measure and I know of no validated one. Measurement is the hard, unsolved part of the control budget. A firm that adopts the idea should expect to spend more effort on the gauge than on the rule, and should treat its first version as an experiment that the second line reviews.

3.7 Reading revealed values from the record

A common control arrangement in a factory is a loop of three things: policy, which states in executable form what should be true; actuals, the record of what the estate did; and audit, the standing comparison of the two. Read as a values instrument, policy is the firm’s stated values, actuals are its revealed values, and audit measures the gap.

The Netflix sentence translates directly. In a factory, the actual values are shown by what the gateway blocks, what the veto stops and what the waiver trail excuses. The firm can read them from its own audit record: for each value, count the times its policy fired a veto and the times a waiver was granted against it. A veto that fired is a value caught in the act of costing something. A generated database migration that a named reviewer rejects, with a recorded reason, is one such record. A value whose policy has never fired and has never been waived has no recorded cost. It is either so well internalised that it is never tested, or it is decoration, and someone has to decide which.

One constraint is essential. If the factory both produces this evidence and judges it, it is marking its own work. The factory’s loop produces the record; the second line reads it and draws the conclusion. The quarterly review of stated against revealed values is a second-line review using first-line data.

3.8 Three ways it fails

Poster values. No policy, no metric, no veto. In a human organisation these are ignored. My argument in section 3.3 is that in an agent estate they are not neutral, because text placed in a prompt is acted on. That is argument and not measurement.

Values against incentives. This is the structure the Wells Fargo order records, and a factory has a mild form of it built in. In my observation, most AI delivery programmes are funded on a throughput business case: more output per engineer. That is my experience of how such cases are written, not survey evidence. Where it is true, the incentive points at exactly the value the mission most needs to defend, which is control ahead of speed. A mission that does not carry its own counterweight — the control budget, and the supervisor named beside the business — will lose to its funding model.

The long list. A list of values that keeps growing stops ordering decisions and starts justifying them, because every position can find a principle to cite. Where the line falls is a matter of judgement. Mine is that five to eight is the workable range for a list that must also be ordered, and I hold that as a rule of thumb. I know of no study that sets the number. Amazon’s sixteen are an example of a long list [5], not evidence that long lists fail.

4. A method, and a worked illustration

The method and the example in this section are proposals.

4.1 Six steps

1. Derive before drafting. Over about two weeks, interview the people the factory serves and answers to: product leads, the chief risk officer, and the function that deals with the supervisor. Write down what each would lose if the factory disappeared. Assemble the mission from the losses.
2. Draft the four artefacts separately. Mission: at most two sentences, naming both the business and the supervisor. Mandate: what the factory may do and the list of what stays outside it. Operating principles: five to ten decision rules already in use or immediately adoptable. Values: five to eight, ordered, each with its owner, policy, metric and veto sketched on the same line. A value proposed without its enforcement sketch goes back to its proposer.
3. Run the two-compiler test. Every value must compile twice: into a human consequence (a hiring criterion, an input to promotion, a veto a named person can exercise) and into a machine consequence (a clause in the preamble, a policy rule, a stop condition). A value that compiles into neither is deleted. A value that compiles into only one is marked as half-built.
4. Ratify as governance. The mission and the order of values go to the executive committee. The values that set risk trade-offs, above all the control-budget threshold, go to the chief risk officer for second-line approval before that meeting, in writing. This also changes the politics: the mission becomes something the risk and security functions helped to write.
5. Compile and version. The ratified document enters the machinery backlog with a version number. One release updates the shared preamble, the policy rules and the autonomy criteria. The audit record shows which version each agent action ran under.
6. Review revealed values each quarter. The factory reports, per value, vetoes fired, waivers granted and the trend. The second line reads the report. A value with no recorded cost in two consecutive quarters is examined and either sharpened or removed. Revise the document when events require it and not on an anniversary.

I call the ratified document — mission, mandate, principles and ordered values together — the factory’s charter. The word is less tainted than “mission and values” and describes what the document is: a grant of authority with conditions.

4.2 Worked illustration

The following is an illustration of the method. It is not a recommended mission and not a recommended list of values. A firm that copies it has skipped step 1, which is the step that makes the result its own. The example is for a composite firm and does not describe a real institution.

Illustrative mission: The factory exists to turn the firm’s intent into running, evidenced software, at the speed the business needs and inside limits the supervisor can inspect, so that change is never faster than the firm’s ability to stand behind it.

Each clause traces to a failure named in section 3.4: “intent into running software” to embedding in value; “evidenced” and “the supervisor can inspect” to the second party; “never faster than the firm’s ability to stand behind it” to the control gap.

Three values are worked in full. The order is part of the example.

The order does work here. Value 1 outranks any value about meeting demand, which is why the control budget may throttle intake while the business is asking for more. Value 2 outranks any value about using the standard route, which is why even a pre-approved pattern cannot ship without evidence.

A further five candidates are listed without their enforcement columns. By the rule in section 3.5 they are not yet values; they are sentences waiting for an owner, a policy, a metric and a veto.

Whether these are the right candidates, and the right order, is exactly what step 1 and the ratification in step 4 are for. The proposal is the shape: few, ordered, owned, each row complete, and nothing on the list that fails the two-compiler test.

5. Recommendations

1. Find out how many missions the estate already has. Collect the system prompts in use and read what each says about purpose and priority. The number of distinct statements is the size of the problem.
2. Write one shared preamble and own it centrally. Release it through the machinery backlog with a version number, and have every agent’s configuration declare the version it uses.
3. Apply the four-part test to every existing value. Owner, policy, metric, veto. Delete or complete the ones that fail.
4. Name the supervisor beside the business in the mission. Avoid commercial vocabulary for that relationship.
5. Order the values, keep them few, and separate the two tiers. Rules with a veto go to the policy engine. Ordered priorities with their reasons go to the preamble.
6. Pilot a control budget in one domain, as an experiment. Weight it by review quality. Have the second line approve the threshold and review the gauge.
7. Add version-of-mission to the audit record, so that drift between what people and agents are working to can be detected.
8. Give the quarterly reading of vetoes and waivers to the second line. The factory supplies the data and does not grade itself.
9. Check the business case against the mission. If the factory is funded on throughput alone, the funding model and the first value are in conflict, and the board should be told so.

6. Limitations

• The central claims are argument. That agents act on vague values in harmful ways, that poster values are worse than none in an agent estate, and that value drift between people and agents will occur are reasoned expectations. None has been measured. The METR evidence cited concerns agents gaming automated scores in evaluations, which is a neighbouring phenomenon and not the same one.
• The precedent is weaker than the idea first suggests. Anthropic’s constitution declares an order of priority but describes it as holistic, prefers judgement to rules, and reserves bright lines for a short list. It supports a two-tier design. It does not support the claim that an ordered list of values resolves conflicts mechanically. It is also a training-time document for a general model, and a firm’s preamble is a run-time instruction to a task-specific agent; the transfer between the two is assumed here, not shown.
• The control budget is unmeasured. The analogy with the error budget holds in structure only. No validated measure of review capacity or review quality is offered, the illustrative thresholds are placeholders, and the candidate measure is costly and can be gamed. It may turn out that the budget cannot be measured well enough to carry an automatic consequence.
• The four-part test and the six-step method are untested. They have not been evaluated in a controlled comparison, and I report no outcome data from any firm.
• Counting vetoes is a crude reading. A value that never fires may be well designed upstream. A value that fires constantly may be badly drafted. The count starts a review; it does not conclude one.
• The independence arrangement is asserted, not designed. The paper says the second line must read the evidence the factory produces. It does not specify how the second line verifies that the evidence is complete, nor how the arrangement scales.
• Ownership above the factory is open. A group may have a mission, an AI governance committee and several factories. Which body owns which document, and how a group-level ordering constrains a factory-level one, is not addressed.
• The number of values is a rule of thumb. Five to eight is my judgement, and the statement that funding cases are mostly throughput cases is my observation.
• The account of how Amazon uses its principles in hiring and promotion is common account, not verified against a primary document. No Enron document was opened; the Enron values are cited as reported in Netflix’s 2009 deck.
• Drucker is paraphrased, not quoted. The 1954 book was not consulted for this paper. His argument is given in my own words, and the imprint is taken from a library catalogue record.
• The regulatory statement is a technologist’s reading, as of November 2026, and is not legal advice. The AI Act references were verified for Working Paper 04 of this series on the same day and are reused. Operational-resilience obligations under EU, UK and Swiss rules are not analysed here.
• Verification. The source checks for this version were carried out by an AI research agent on 10 November 2026. That is not peer review, and the paper has not had a legal or practitioner review.

References

Sources 1 to 12 and 14 were opened on 10 November 2026. Source 13 could not be opened in full text. Sources 15 and 16 were verified on the same day for Working Paper 04 of this series and are reused here.

1. Consumer Financial Protection Bureau, In the Matter of Wells Fargo Bank, N.A., Administrative Proceeding File No. 2016-CFPB-0015, Consent Order, filed 8 September 2016, paragraphs 8, 9, 14, 16 and 23. https://files.consumerfinance.gov/f/documents/092016_cfpb_WFBconsentorder.pdf
2. Netflix (uploaded by R. Hastings), “Culture” slide deck, 2009, slides 5 to 7; first slide labelled as an archive of a prior version. https://www.slideshare.net/slideshow/culture-1798664/1798664
3. Netflix, “Netflix Culture Memo”. https://jobs.netflix.com/culture
4. S. Ezama, “Sharing Our Latest Culture Memo”, About Netflix, 24 June 2024. https://about.netflix.com/en/news/sharing-our-latest-culture-memo
5. Amazon, “Leadership Principles”. https://www.amazon.jobs/content/en/our-workplace/leadership-principles
6. Amazon, “Amazon announces two new Leadership Principles”, About Amazon, 1 July 2021. https://www.aboutamazon.com/news/company-news/two-new-leadership-principles
7. M. Alvidrez, “Embracing Risk”, Chapter 3 in B. Beyer, C. Jones, J. Petoff and N. R. Murphy (eds.), Site Reliability Engineering: How Google Runs Production Systems, O’Reilly, 2016. https://sre.google/sre-book/embracing-risk/
8. Anthropic, “Claude’s Constitution” (CC0 1.0). https://www.anthropic.com/constitution
9. Anthropic, “Claude’s new constitution”, 22 January 2026. https://www.anthropic.com/news/claude-new-constitution
10. Anthropic, “Claude’s constitution”, 9 May 2023. https://www.anthropic.com/news/claudes-constitution
11. Cloud Native Computing Foundation, “Open Policy Agent (OPA)” project page (accepted 29 March 2018; graduated 29 January 2021). https://www.cncf.io/projects/open-policy-agent-opa/
12. Open Policy Agent, documentation, introduction. https://www.openpolicyagent.org/docs
13. P. F. Drucker, The Practice of Management, New York: Harper & Brothers, 1954. Imprint as given in the library catalogue record of the 1954 edition; cited for the argument, not quoted.
14. METR, “Recent Frontier Models Are Reward Hacking”, 5 June 2025. https://metr.org/blog/2025-06-05-recent-reward-hacking/
15. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), OJ L, 2024/1689, 12.7.2024 — Articles 6, 12 and 14; consolidated version of 27 July 2026. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727
16. Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI), OJ L, 2026/1744, 24.7.2026 — amendment to Article 113 of Regulation (EU) 2024/1689. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202601744
17. M. Parente, Technology Management and Agent Readiness, DEIXEI Research Series, Working Paper 04, November 2026, section 3.6.