Earning the right to press send

A first-year apprentice does not get handed the van keys on his first Monday. He gets watched, corrected, watched again, and some months later he is left to second-fix a bedroom on his own while somebody else works the landing. Every trade in the country has handled trust that way for as long as there have been trades, and it is the model we have taken for how much Red Button is allowed to do without asking. We have made it literal.

This matters more than the feature list, because the feature list is the easy half. Software that reads what you said and works out what to do with it is now fairly ordinary. Software you would let near a customer's inbox without checking is another thing entirely. What earns that is a long run of drafts you checked and found correct, and there is no shortcut to the far end of it.

Everything starts at the bottom

Every capability begins as an apprentice: it drafts, and it asks. It writes the invoice line and shows it to you. It composes the email and puts it on the screen with the send button under your own thumb. It files a fact into the knowledge base and marks it unverified until somebody says otherwise. Nothing leaves the building at that level, and that is the starting position for every single thing the software can do, without exception and without a setting to skip it.

The apprentice also asks questions, which is the other half of what a good one does. When a job comes up that it cannot place, it asks what an apprentice would ask on a first morning: whose job is this, where is it, how long are we there, what are we trying to do. The answers become structured knowledge at the only moment they are cheap to collect, which is while you are standing in the place being asked about.

The exam is marked, and we can fail it

Promotion has to rest on something better than a feeling that it seems to be going well. So there is a golden set: real captures with the right answer written down against each one. The actions that should have come out of it, the job it belongs to, the summary. It is seeded from history and from every correction the founder has already made, because a correction is a documented failure with the right answer already attached to it.

The set is deliberately weighted towards the cases that break things, because an exam made of easy questions tells you nothing you needed to know.

The runner pushes the whole set through the live pipeline and scores it: how many right, which ones failed, and how each segment did on its own. It takes minutes to run and pennies to score, which is the point of building it early. And it is marked on the worst segment. A change that lifts the overall number while dropping one group does not ship, because the average hides the customer whose accent the model handles badly, and that customer is a real person paying us every month.

No prompt change, no model change and no extraction rule ships on a score drop. The same gate applies to the reflection agent that proposes those changes in the first place: it has to get the harness green before its own suggestion is allowed anywhere near the live system.

An exam made of easy questions tells you nothing you needed to know.

Promotion is per capability, and you hand out the stripes

A capability climbs on its own record. Receipt bookkeeping might be promoted while quoting is still asking every single time, because they are different jobs done by different parts of the system, and they earn their trust at different speeds. Nothing is promoted wholesale. There is no master switch that turns the software from careful to confident.

The control the user actually sees is a slider. Left is training wheels: it asks a lot and verifies everything, which is a slow way to work and the right way to start. Sliding right hands over more rope, one capability at a time, as each one earns it. Nothing promotes itself and no promotion happens quietly in an update. You hand out the stripes.

Demotion works the same way and takes one slip. If something gets a job wrong after promotion, it goes back to asking immediately and stays there until the record justifies moving it again. A trust slider that only travels in one direction is a sales tactic with a dial on it.

Nothing promotes itself. You hand out the stripes.

A small ceremony, deliberately

When a capability earns its promotion, we make a moment of it on screen. Party poppers and a plain sentence saying what it can now do without asking. A promotion is the user handing over a piece of their own firm, and a decision that size should be marked well enough that they remember making it three months later, when something happens on its own and they want to know why. A toggle buried three screens deep in settings fails that test.

Confirm-first is the law underneath all of it

Under the slider, the exam and the ceremony sits one rule that does not move with any of them: a person approves anything that leaves the firm. Promotion changes how much checking a capability needs before it drafts and how much routine it can handle unattended. It never removes the human from the end of the chain where money or a customer is involved.

Every correction anyone makes becomes a new case in the golden set, so a thing that got something wrong is measured against that exact failure from then on. The record is cumulative and it belongs to the user. That is the whole trust story, and there is deliberately nothing clever in it.

• Everything starts as an apprentice.
• The exam is marked on the worst segment.
• Promotion is per capability, and you grant it.
• Demotion takes one slip.
• Money stays gated at the top, whatever the slider says.
• A person approves anything that leaves the firm.

Written on 27 July 2026, alongside what works today and what we mean by finished and route to market. The whole record is on the news page.

Read next