Countersign
Reads run alone. Writes wait for you. An AI agent operating a real admin panel — where the tool surface, not the prompt, decides what the model can get wrong.
role
Product Designer · AI Interfaces
type
Portfolio product · agent governance
year
2026
tools
Next.js · Groq · code-first
3
Governance tiers
8
Agent states
14
Design reviews
1
Human checkpoint
This runs against a real model. Try it.
Try it live →A research catalog that turned into a product
Countersign started as a catalog — 63 AI interface patterns, mapped to sell as a Figma kit. Testing the patterns against a real model turned it into something else: a working admin panel where an agent proposes actions and a human approves the irreversible ones.
Reads run alone. Reversible writes run, then wait. Destructive writes wait first. Friction before or friction after, never both.
The bug that became the thesis
Testing the agent, I ran a harmless read: "list discontinued products". There was no read tool for "discontinued" — so the model reached for the nearest tool by name. And the nearest tool by name was a destructive write.
The read asked for
list discontinued products
Nearest tool by name
discontinue_products
A query that meant to list three products became a proposal to discontinue all 27 active ones. The gate caught it — but a read should never surface a destructive proposal in the first place. I traced why, and closed it.
The fix wasn't a warning in the prompt. It was adding the read tool that was missing — so the verb resolves to a read, not a write. Same model, different surface:
That's when the thesis landed: the tool surface — not the prompt — bounds what the model can get wrong. You don't fix this by telling the model to behave. You change the surface it reaches into.
The corollary
Every fix in Countersign is additive to the surface, never a correction to the prompt. A missing read verb becomes a read tool. A destructive verb gets a gate. The model doesn't get smarter — its reach gets shaped.
Friction scales with how hard it is to undo
Three tiers — not three buckets picked by intuition, but a continuous variable discretized: how far the change reaches, and whether the undo window closes on its own.
Query and filter execute on their own — the table reacts live, nothing waits.
A radius-1 change runs immediately, then waits: undo lives on the action until the next write.
The engine stops at the gate. Nothing irreversible runs until you approve — all, some, or none.
The invariant underneath: the server resolves, the client reflects. Counts, previews, resolved targets — all computed server-side. The human approves exactly what the server will execute, never a guess from the browser.
Real failures, surface fixes
Every one came from watching the agent fail against a real model — then changing the surface, never the prompt.
The failure
Handed 13 rows of data, the model enumerated them in prose and mislabeled the criterion — naming products it wasn't asked about.
The fix
Split the channel. The model gets the count and the criterion, never the rows. With nothing to enumerate, it can only write the preamble. The rows render server-side, beside it.
The failure
A filter left the table at "3 of 30" with no visible way back — and the model denied the view state it had produced.
The fix
The agent uses the user's own filters, not a private channel. The tool surface is a subset of the user's — so the human can always see and undo what the agent did.
The failure
Approve-all-or-nothing was a lie. The resolver was right, but the human held context the system didn't — one row shouldn't ship.
The fix
Partial approval. Untick by human judgment; the server re-intersects the exclusions against its own preview before running. A first-class outcome, not an error correction.
See the agent hit the gate yourself.
Open the scenario →Where the principle stops
The research marked "trust builders" as the core wedge — confidence scores, reasoning chains, self-reported caveats. I dropped all three, because they share one shape: they ask the model to report on itself.
Countersign solves trust the other way: the server renders the true value beside the prose, and the model's self-report becomes unnecessary. When the model confused an entire product, it didn't matter — the real data was right there.
Where it stops
This works for a bounded admin panel. In open-ended research or writing, self-report becomes necessary again — and I didn't solve that. Naming where a principle ends is what makes it sound reasoned instead of dogmatic.
An honest account
Real: the agent runs against a real model; the failures are reproducible with tool names and counts. Code-first: built in code, no Figma mirror — the loop was watch it run, spec the fix, review. Fictional: Northbase and its catalog are entirely invented. My role: specs, decisions and review are mine; execution delegated to Claude Code, and the review log is the paper trail.
See it running
The demo runs on a real model over simulated data — sandbox, no login. Four guided steps, then free input.
Northbase is fictional. The governance isn't.
Open the demo →Countersign — an AI agent with a human checkpoint
Live demo →