alidoes.ai

All writing

Post-mortem

I stepped down from the board. My AI didn't.

An AI workspace doesn't know you quit. Mine kept encoding board authority I no longer had, until the whole domain was flipped to a hold a script can verify.

Key findings

  • The workspace that ran board operations kept encoding the role after it ended: 21 project ledgers, a generated dashboard, and a scheduled daily refresh all assumed authority Ali no longer had.
  • The fix is machine-checked, not remembered: a posture flag the dashboard generator refuses against, frozen banners on every ledger, and a scheduler replaced by a byte-compared no-op tombstone.
  • A read-only checker with three exit codes audits the hold and must fail on a planted authority regression before its pass counts.

I stepped down as board president. The AI workspace that had run board operations kept the authority — so the whole domain got flipped to a hold a script can verify.

A role change is a context bug. Nothing in an AI workspace expires on its own: every ledger, dashboard, and scheduled task keeps your old job alive until something machine-checked says otherwise.

Role change to machine-checked hold: how the workspace stopped acting on stale authority A role ends. The workspace doesn't notice until a check makes it. FAILURE PATH Role ends board president steps down nothing in the files expires → Workspace keeps the role 21 ledgers · action dashboard scheduled daily refresh → Stale authority next session inherits a job that no longer exists THE MACHINE-CHECKED HOLD HOLD flipped on 2026-07-27 posture flag · banners on all 21 ledgers generator refuses, output byte-identical scheduler replaced by a no-op tombstone → Read-only boundary checker exit 0 pass · 1 regression · 2 blocked blocked = could not evaluate safely must fail a planted authority regression
The failure path (a role ends, the files keep encoding it) and the hold that catches it. Diagram source: this page; maps 1:1 to the owner-boundary checker's AUTH-* and SCHEDULE-* checks.

What did the workspace still believe after I left?

That I could act for the board. The domain held 21 project ledgers, a generated action dashboard (last built 2026-07-01), and a scheduled task that refreshed it daily. All of it was written for a president: draft the vendor reply, chase the deadline, assign the next step.

None of that data was wrong, exactly. It was stale in the most dangerous way — authority encoded as ordinary files. A fresh AI session reads those files and politely inherits a job I no longer hold. The failure isn't the model misremembering; it's the model correctly reading a workspace that lies about the present.

Details here are generalized to protect the people involved: an HOA where I formerly served as board president. No names, no buildings, no matters.

Why isn't telling the AI enough?

Because prose isn't enforcement. I could write "Ali is no longer president" in a memory file, and it would work until the one session that skims past it. Instructions decay, sessions start fresh, and the old files outnumber the new sentence a thousand to one.

So the hold is machine-readable. The domain's context file carries operating_posture: HOLD in its frontmatter (the structured header at the top of a file that a script can parse). Every one of the 21 ledgers now opens with a frozen-snapshot banner.

One wrinkle I refuse to hide: those ledgers still say state: active, because the workspace's lifecycle vocabulary has three states and inventing a fourth would break the tooling that reads it. Instead the rule is written where the checker can see it: state: active is a lifecycle value, not proof that I own the action. Same discipline for time: a deadline that passed with no recorded outcome is written NOT CAPTURED — never inferred as done, and never treated as urgent work assigned to me.

How does retired automation stay retired?

Two ways, both checkable.

The dashboard generator now refuses while the posture flag is set: it exits with code 2 and prints REFUSED. The checker hashes _dashboard.md before and after that refusal to prove the run left the file byte-identical. A generator that "refuses" but still touches its output is a generator that half-ran.

The scheduled refresh task, open-loops-board-refresh, was not deleted — deletion is invisible. It was replaced with a tombstone: a no-op prompt (one that does nothing on purpose) whose entire job, if ever invoked, is to answer RETIRED_NOOP id=open-loops-board-refresh state=retired. The checker byte-compares every stored copy of that prompt against exactly two allowed retired versions. Then it sweeps the other places a duplicate could hide — the desktop app's task registry, a second agent's automation folder, Windows Task Scheduler itself.

Even here the record stays honest. At one recorded snapshot, the stored copies of the retired prompt had drifted out of byte-parity with each other. That is logged as an open checker finding — not quietly patched, and explicitly not permission to rewrite the task.

Who checks that the hold still holds?

A read-only Python checker audits all of it when a session enters the domain, and it has three exit codes, not two. Exit 0 means every encoded control passed. Exit 1 means a deterministic regression (same inputs, same verdict, no judgment in the loop). Exit 2 means blocked: something could not be evaluated safely. "I can't tell" is a first-class answer, never rounded up to a pass.

Its checks have dull, specific names: AUTH-MACHINE-POSTURE, AUTH-STATUS-BANNERS, SCHEDULE-GENERATOR-REFUSAL. And the domain's own acceptance gate carries the requirement I'd now apply to any guard: the checker must fail on a planted authority regression. A check I have never watched fail is decoration. It's the same cannot-fail-silently philosophy as the rest of my system, pointed at a problem most setups never name: the workspace itself as a source of stale power.

Somewhere in your AI's context sits a role you've already left — an old job title, a closed project, a committee you rotated off. The files still read like you hold it. What, other than your own memory, would notice?

Method & data

Method: the owner-advocate hold on an HOA workspace Ali formerly ran as board president — its domain context and status files, the frozen ledger banners, the retired-scheduler tombstone, and the read-only owner-boundary checker
Data: patterns and methods only; no names, dollar figures, addresses, case identifiers, or confidential content · Last checked: 2026-08-14

How this was made

AI-drafted, adversarially checked, human-directed. My AI assistant wrote this from the system's own records — the domain's context and status files, the retired-scheduler tombstone prompt, and the read-only owner-boundary checker with its named checks. A separate AI session then tried to break every claim against those records, and automated privacy and readability gates ran before publish. I direct this pipeline, own every boundary in it, and audit published pages on a rolling basis — if you find an error, tell me and it goes in the corrections log, dated, never silent.

I'm Ali — I run real life-and-work admin on AI agents, then check their work in the open. More at /about.

Published under my standards. Found an error? Tell me — corrections go in the corrections log, dated, never silent.

Cite this

@online{ali2026roleauthority,
  author = {Ali},
  title  = {I stepped down from the board. My AI didn't.},
  date   = {2026-08-14},
  url    = {https://alidoes.ai/ai-authority-when-roles-change/}
}

Caught something I got wrong? Send it directly. Confirmed corrections go in the corrections log.