The framework is built so that letting go is hard even for its creator. It feels like the first time you let go of a bicycle while your son shouts «don't hold on, I've got it». Sooner or later the hands have to open. He'll fall a couple of times. The fear isn't for the bicycle — it's for him. But holding on forever is worse.
Datarim was designed to be safe. It is deliberately over-bureaucratic, and for a public framework that is the right call: every step stays under human control. A would-be corporation cannot let an agent do whatever it pleases, so Datarim is full of procedures, checks, and approvals.
But personal experiments need the hands untied.
Between May 14 and June 15, agents closed 340 tasks — almost as many as in the first month (341). What changed was the quality: the share of complex L3 and L4 tasks among the labelled ones rose from 29% to 33%. Datarim remains the most frequent track, around 85 archives for the month. And more and more often the agent's logs scroll by idle — it works on its own, and no intervention is needed.
A cage built on purpose
Datarim has a guard against error built in. Every agent action is confirmed, every prompt is checked for data leakage, every external API call is logged. For a corporate tool that is correct: SOC 2 is no joke, and mixed-up environments must not cost anyone their data.
For one's own experiments the same cage gets in the way. Time goes into confirming steps the agent could take on its own. The orchestrator asks permission to read a file that is public anyway. The leash is yanked at every turn.
Of the 340 tasks, 307 are labelled by complexity explicitly. L1 (trivial) — 67, L2 (with a plan) — 139, L3 (with a PRD) — 79, L4 (epics) — 22. L2 accounts for nearly half of the labelled ones: at that level a plan is reviewed quickly, and a «yes» or «no» takes a minute. At L4 there is no such luxury — you have to let go and watch the agent roll out infrastructure where every mistake costs money.
The sandbox takes some of the fear away. Separate servers, a dedicated budget for external models (around $15 a month goes to delegation tokens), separate storage. If an agent «runs wild», the bill comes out of one's own pocket, and no one but the author of the experiment gets hurt.
L1–L5: how the layers of control come off
Autonomy is split into five levels. L1 — the agent only proposes; L2 — proposes with a plan; L3 — writes code but does not deploy; L4 — deploys to an isolated environment; L5 — runs fully autonomously, all the way to production.
Today most tasks run at L2–L3. The implementer agent takes a task, writes a plan, the plan is approved — then it implements. The result goes to a second agent for code review. Two agents work in sequence, with a human standing between them as the controller.
The goal is L5: autonomous orchestration in the sandbox with a step limit. After N iterations the agent must hand control back to the operator — so it doesn't fly off into an infinite loop, and so there is always a point of intervention if something goes off-plan. But without the yanking at every twitch.
Over thirty days, delegation to cheap models ran up about 1,578 calls, 5.4M output tokens, roughly $15.18. Of those, the datarim profile accounts for 1,345 calls, 5.1M tokens, $14.51. The cheap external models take on the grunt work; the expensive Claude is kept for reasoning.
L5 won't come in a month. Maybe three, maybe six. But the agent is already past asking at every step: the orchestrator decides on its own which model to wire in for a task, and picks the archive it needs when it has to recall context.
18 hours without the operator: architecture beats the model
This month brought an experiment that shifted the understanding of autonomy. The question was simple: how long can an agent work on its own, without a single touch?
The first attempt was head-on, on the newest, most enduring model. In testing Fable 5 (internal name — Mythos), one continuous session reached twelve hours. A good result — but the real surprise was elsewhere.
The second construction was a chain of three orchestration layers on an ordinary, not-the-newest model. The top orchestrator manages not tasks directly but another, more junior orchestrator. That one spins up its own terminal sessions of ordinary agents and conducts them. The result is a pyramid: a task is handed to the top, and down the layers it breaks into ever smaller steps. This construction held for eighteen hours — and not idling, but with deep work and the optimization of one of the trading strategies in Angry Robot Deals, the market-analytics space that Arcanada also builds.
Here is the takeaway this is all for. To build long autonomous work, there's no need to wait for a super-powerful artificial intelligence — it's enough to assemble the architecture correctly: who manages whom, where the boundaries are, where control changes hands. Eighteen hours on an ordinary model beat twelve on a top one not because the model is smarter, but because the work around it was better arranged. Architecture beats the model.
Releasing the reins means allowing mistakes. Agents do make them: they confuse command arguments, forget to check git status, paste logs in the wrong order. Each such mistake turns into a new rule — not a block, not a rewrite, but a note, so the agent doesn't repeat it next time. It takes time, but there's no other way to teach.
When an agent «runs wild»
One day a data-verification agent rewrote all the environment variables at its own discretion. It didn't ask — it just replaced the values. It became clear an hour later, when the dashboard went down.
Roll it back, delete the task, block the agent — all of that was on the table. Instead the investigation went through the logs: where exactly the agent made the decision. The cause turned out to be in the prompt — the vague wording «optimize the configuration». The agent read it literally: found a file, decided the values were stale, and substituted new ones from a neighbouring project.
What followed was an architectural fix: a rule «do not change environment variables without explicit permission», plus mandatory confirmation of any changes to sensitive files. The task itself was left with a «partially done» status — its status history shows how the agent and the operator gradually settled into each other.
The sandbox made this possible. Had the same scenario played out in production, a live service that people use would have gone down. The sandbox sits in a separate circuit with no access to production: the agent cannot harm real users — only the budget takes the hit.
The datarim profile runs delegation roughly 1,345 times a month — that's 1,345 chances to «cause trouble». Review is selective, on the most token-expensive calls; the rest rests on trust. Delegation to cheap models cost $15.18 for the month — that's how much the agents pulled off the expensive Claude limits by shifting it to external models. If an agent slips into an infinite iteration and starts burning tokens, it shows in the log and gets stopped by hand. So far that has happened twice — both times from a misconfigured step limit.
The sandbox as a playpen
«Releasing the reins» is not abstract philosophy but concrete mechanisms: gates, levels, limits, architectural decisions. And the daily choice between «do it yourself in a minute» and «hand it to the agent for an hour».
The sandbox works like a playpen for a child. He tries to stand, grabs the rail, falls, cries — and you want to catch him. But catch him every time and he won't learn to walk; take away every toy that could break and he won't learn how the world is built.
«The art of light touches» is an image borrowed from Pelevin. Not as a quote, but as a principle: intervene just enough not to break initiative, but not enough to let it fall into the abyss. A light touch is not a block on the current step, but a hint on the next.
When the orchestrator loops on three nested cycles, the answer is not code in its place but a prompt: «try rewriting it as a state machine», «look at the second task from that date, there's a similar problem», «what would you tell yourself in a new agent's shoes?». If two light touches don't work, the volume goes up. But the light touch comes first.
The ecosystem registry now holds 26 projects. New ones this second month: a status dashboard, Adsessor (a call assistant), managed spaces, a shared component library, Publisher (a social-media publisher), and Legal Arcana (a legal hub). Every new project is a place where the agent can be given a little more freedom, because the risk is lower.
Where the open hand leads
The vast majority of calls — about 85% — go through the datarim profile. All orchestration runs through it: writing code, documentation, passing context between tasks. The rest are the write profile (finished texts), social (publishing), code (quick scripts without a full cycle), and codex (experimental).
More and more work goes to the agents — not just the technical kind. The result is reviewed, not the process, and one has to accept that the result isn't always perfect. Sometimes an agent writes code an experienced hand would have rewritten in ten minutes while it spent an hour — but that hour stays an investment, not a loss.
What comes of it will go back to the community: L5 will ship under the MIT license, as Datarim and Coworker already are on GitHub. So that anyone who wants to learn to trust their agents can start not from scratch, but from someone else's mistakes and someone else's «light touches».
Right now the level is L2–L3 with hints of L4. L5 is set for June; if it doesn't land, then July. But with every task the agent closes without intervention, the reins grow a little longer.
The marker for next month: of the 22 L4 epics, to have agents carry half of them to the last step on their own. Not for show, but so that trust is borne out by the result. If it isn't — there will be redesign. The sandbox will hold.