governance ai|human: the draft-and-confirm switch that earns trust

The question that kills agent rollouts is 'what if it says something wrong to a customer?' rysh's answer is a per-channel switch.

Every conversation about putting an AI agent in front of real people hits the same wall, usually within ninety seconds:

"What happens when it says something wrong to a customer?"

And the honest answer, for most bot platforms, is: you find out afterwards. The bot posts, the screenshot circulates, and the AI initiative quietly gets rolled back to an internal FAQ tool. Not because the model was bad — because nobody was given a way to hold the leash while trust was still being built.

rysh bakes the leash into the platform as one switch, set per humanoid, per channel:

##humanoid governance support-bot human   # draft-and-confirm
##humanoid governance support-bot ai      # autonomous, logged

What human mode actually feels like

A rysh humanoid is an agent with external channels — email, website chat, Slack — defined in a single markdown skill file. In human mode, an inbound message does not produce an outbound reply. It produces a draft, in your terminal.

A customer emails support@. The channel stays silent. In the humanoid's pane, the agent's proposed reply appears — full text, in context, next to the shell you're already working in. You read it. If it's right, you confirm and exactly one reply goes out. If it's wrong, you edit the ask or answer it yourself. Nothing reaches the customer until a person has the last word.

That's the whole mechanic. No approval dashboard, no separate review queue SaaS — the draft lands where you already live, and the send is an explicit human act.

Draft-and-confirm is live today for email and website chat.

What ai mode is (and isn't)

ai mode is autonomous: the humanoid answers on its own. What it isn't is a black box. The humanoid runs on your machine, spawned from a skill file you wrote, calling a model with your own API key, and every exchange is logged. Autonomy in rysh means "no human in the loop for this channel," not "no human can see what happened."

The two modes share everything else — same agent, same persona, same knowledge. The only thing the switch changes is who has the last word.

Per-channel is the part that matters

Trust isn't one decision; it's a decision per audience. The same support-bot might reasonably run:

Three-separate-bots architectures can't express this — each bot has whatever autonomy its codebase hard-wired. Because a rysh humanoid is one agent with per-channel adapters, the trust level is configuration, changed live with one command, no redeploy.

The trust ladder

The pattern I'd actually recommend to a team rolling out their first humanoid:

1. Week one: everything human. You're not slowing the agent down; you're reading its mind. Every draft is a free audit of how it handles your real traffic.
2. Fix the file, not the vibes. Wrong answers trace back to the skill file — a missing fact, a fuzzy instruction. Edit the markdown, respawn, watch the drafts improve. The file is in git, so the improvement is a reviewable diff.
3. Flip the low-stakes channel first. When a week of website-chat drafts needed zero edits, governance ai that channel. Keep email on human as long as you like — forever is a legitimate choice for regulated teams.
4. Keep the hard stops handy. @@support-bot deactivate stops the agent; ##humanoid channel stop support-bot email takes one channel offline. De-escalation is always one command.

This is how humans earn autonomy at work, incidentally. You don't give a new hire the customer list on day one; you review their drafts until you stop needing to. The switch just makes the same ladder available to software.

Why this is the foundation, not a feature

I keep coming back to a simple claim: the blocker on agents doing real work isn't capability, it's governability. Models are already good enough to draft most support replies. What's been missing is the apparatus that lets a careful team say yes, under supervision instead of no — and to relax the supervision at their own pace, per channel, with receipts.

That's why governance in rysh isn't an enterprise add-on tier. It's the default shape of the platform: every tool call visible in a pane, dangerous operations gated on approval, secrets redacted client-side, and — for humanoids — this switch.

Honest scope, as always: live channels today are Slack, email, and website chat (WhatsApp and phone are roadmap, not live). rysh runs on Claude with your own key; the provider layer is pluggable. Self-hostable, not open source. Private beta.

Start in human mode. Let the agent earn ai. That's the whole philosophy in two commands.

If "yes, under supervision" is the answer your team has been looking for, we're onboarding design partners — you'll get the switch, and a direct line to the people building it.

More in this series: Humanoids: agents with a Slack handle · One SKILL.md, three channels