White paper · October 2026 · 5 min read
The Control Tower Method
Roadmaps, gates and maturity: how I move a product's control areas from manual to autonomous, with multiple AI agents working under controls.
01At a glance
Every product runs on controls: the checks, reviews and decisions that keep it working. Most are manual. AI agents can do that work, but an agent without controls is just a faster way to break things.
The framework
Split the product into control areas and score each from L0 (not done) to L5 (autonomous). An agent gets more authority in an area only when the evidence supports it.
What I built
At NFI: 27 control areas on an enterprise platform. At CorkAI: the whole system, from roadmap to tests, with multiple Claude Code agents doing the building.
Results so far
The gates are enforced and the tests already caught real defects before release. Most of the foundation is in review, not yet released.
The end game
Where failure is expensive, agents detect, fix and document known problems inside limits I approved in advance. People handle strategy and exceptions.
The model writes the code. The operating model decides whether the code is any good, and how much an agent is trusted to do on its own.
02The framework
A control area is anything the product depends on that can fail without anyone noticing: a feature like billing or sign-in, or part of the engineering system like testing or releases. Each area gets a current level, a target and the evidence behind both. Not every area needs L5.
Not done
Nobody checks it. Users find the problems.
NextGive it an owner
Manual
A person checks it, sometimes, their own way.
NextWrite the standard
Partly automated
Some checks run, but a failure stops nothing.
NextCI that can refuse a change
Checked on every change
A failure blocks the release. The biggest jump.
NextProduction alerts
Measured, with alerts
Drift reaches the right person, with a runbook.
NextTrack record + pre-approved fixes
Autonomous, under control
An agent fixes known problems within approved limits and leaves evidence.
ThenAudit the evidence trail
| L1 · Manual | L5 · Autonomous, under control | |
|---|---|---|
| Who notices | A user, or someone who happens to look | A production check, within minutes |
| Who fixes | Whoever is available, by hand | A controlled agent, using a pre-approved fix |
| Who decides | Decided on the spot, under pressure | The owner, in advance, for known patterns only |
| Evidence | Memory and chat threads | Logged automatically, reviewed in the digest |
03What I built
NFI Industries
Enterprise digital-twin platform · 10 accounts
27 control areas, each scored L0–L5
- A plan to move each area from manual controls toward autonomous execution (APEM)
- A roadmap control tower showing the plan and the maturity trajectory side by side
- ADRs to record the decisions that shape the platform
CorkAI
AI-native wine app · web, iOS, Android
12 control areas, built by multiple Claude Code agents
- Plan: about 100 work items, each with "done looks like" and "tests required"
- Gate: a review packet on every pull request, enforced by CI
- Prove: about 1,150 tests on every change, from unit to browser journeys
How decisions get remembered
Agents start every session with no memory, and people move on. So every decision that's expensive to reverse gets an architecture decision record (ADR), at NFI and at CorkAI. Agents read the relevant ADRs before they work, so settled decisions aren't reopened, and whoever comes next inherits the why, not just the code.
A costly-to-reverse choice
Architecture, data model, vendor, AI model or security
An agent writes it
Context, options, decision, consequences, how we'd know it's wrong
I approve it
In the same pull request as the code it affects
It becomes the rule
Agents read it before touching that area
Never deleted
A new ADR links back, so the reasoning trail stays whole
Where this panel sits in the control tower
04Results so far
The CorkAI foundation was built in one intensive working session, and most of it is in review, not yet released. What's already true:
05The end game
Not everything at L5: every area at the level its risk justifies, with evidence to prove it. For CorkAI that's L5 within six to nine months where a silent failure is expensive, and L3–L4 elsewhere.
| Area | Q4 2026 | Q1 2027 | Q2 2027 | Target | ||
|---|---|---|---|---|---|---|
| TodayOct | M2Dec | M4Feb | M6Apr | M8Jun | ||
| Product areas | ||||||
| Recommendations | L1 | L2 | L3 | L4 | L5 | L5 |
| AI sommelier chat | L1 | L2 | L3 | L4 | L4 | L4 |
| Billing | L2 | L3 | L4 | L4 | L5 | L5 |
| Social & events | L0 | L1 | L2 | L3 | L3 | L3 |
| Engineering system | ||||||
| CI/CD & release | L2 | L3 | L4 | L4 | L5 | L5 |
| Monitoring & incidents | L1 | L3 | L4 | L4 | L5 | L5 |
| Docs & decisions | L1 | L2 | L3 | L3 | L4 | L4 |
What L5 looks like
Detect
A production check sees recommendations stop personalizing for some users.
Triage
An agent gathers logs and the last change, and matches a known pattern.
Act
The fix is pre-approved, so the agent flips the kill switch to the previous model.
Verify
The same checks confirm recovery, and the evidence is logged.
Decide
I read the digest. My only decision is when to fix the root cause.
That's the end state for CorkAI, and it's the same direction for NFI's 27 control areas: controlled agents run the controls, and people own strategy, approvals and the exceptions.
06What this means for a product org
Build the factory first. Then let the agents build the product, and let the evidence decide what ships.