# THE TOBOGGAN DOCTRINE ## Gravity-Fed Governance for AI Agent Lifecycles ### How Template-Driven Channels Replace Hook-Based Walls in Production AI Operations **Jeep Marshall** LTC, US Army (Retired) Airborne Infantry | Special Operations | Process Improvement April 2026 --- ## ABSTRACT Managing autonomous AI agents at scale is the defining operational challenge of 2026. Current approaches -- guardrails, RLHF alignment, prompt engineering -- address symptoms without establishing a governance lifecycle. This paper introduces the Toboggan Doctrine: a gravity-fed governance framework derived from 270+ Claude Code sessions, 498 registered tasks, 8,000+ git commits, and 398 documented lessons learned across 75 days of continuous multi-agent operations in a single practitioner's Obsidian vault. The core insight is empirical, not theoretical: template-driven channels that make the right decision the default decision outperform hook-based enforcement that catches errors after they occur. The framework synthesizes military doctrine (OODA, MDMP, Mission Command), Lean Six Sigma (DMAIC, CPI), and information theory into a self-improving governance lifecycle where agents enter heavy with preparation, gravity pulls them through pre-made decisions, and each cycle feeds lessons back into the templates. Evidence from a production email pipeline (100% first-pass yield across 210 messages) and a 25-skill governance audit (11 agents, 4 specialist lenses) validates the approach. The Toboggan Doctrine is compatible with OWASP's Agentic Top 10, Microsoft's Agent Governance Toolkit, and existing enterprise frameworks -- but inverts their assumption that governance means adding enforcement layers above the agent. Instead: build the channel, let gravity work, measure the results, retire the walls. --- ## 1. INTRODUCTION: THE HERDING CATS PROBLEM The AI industry has a coordination problem it cannot engineer its way out of. Gartner projects that 40% of enterprise agentic AI projects will be canceled by the end of 2027 due to rising costs, unclear value, and weak risk control.[^1] A Deloitte survey of 3,235 global leaders found that only one in five companies has mature governance for AI agents.[^2] The market is projected to surge from $7.8 billion to over $52 billion by 2030, and most of that money will be spent on agents that organizations cannot reliably govern. The dominant response has been to add more guardrails. OWASP published its Top 10 for Agentic Applications in December 2025 -- the first formal taxonomy of risks specific to autonomous AI agents, covering goal hijacking, tool misuse, identity abuse, memory poisoning, cascading failures, and rogue agents.[^3] Microsoft released its Agent Governance Toolkit in April 2026, a seven-package system with sub-millisecond policy enforcement, execution rings modeled on CPU privilege levels, and dynamic trust scoring on a 0-to-1000 scale.[^4] Both are technically excellent. Both share an assumption: governance means intercepting agent actions at runtime. This assumption is wrong. Not because runtime enforcement is unnecessary -- some actions are catastrophic and irreversible and must be blocked. But because a governance architecture built primarily on interception produces a system where every improvement to agent behavior requires a corresponding enforcement mechanism, and every enforcement mechanism adds latency, complexity, and friction that degrades the performance it was designed to protect. The papers in the Herding Cats series have documented this pattern from multiple angles. Paper 1 established that AI needs doctrine, not more intelligence.[^5] Paper 2 showed that the military already has the coordination frameworks the AI industry is rediscovering.[^6] Paper 3 tested both theories in a live vault and found that twelve of fourteen predicted failure modes appeared within seventy-two hours of multi-agent introduction.[^7] The case study on session close automation proved that separating judgment from execution produced an 87% reduction in tool calls and a process sigma improvement from 3.2 to 4.6.[^8] This paper synthesizes those findings into a single governance doctrine. The thesis is this: **the future of AI agent governance is not more walls. It is better channels.** Build the toboggan. Let gravity do the work. --- ## 2. THE KILL ZONE ANALOGY In military defensive operations, the commander does not build walls and hope the enemy walks into them. The commander shapes the terrain. Obstacles are positioned to slow and redirect enemy movement. Engagement areas are established where natural or man-made features limit the enemy's options. Fires are concentrated -- artillery, direct fire weapons, air support -- all registered on the engagement area before the enemy arrives. The enemy is not stopped by a wall. The enemy is channeled into a kill zone where every weapon system is already aimed, every contingency already planned, every response already rehearsed.[^9] The critical insight is not about destruction. It is about economy of force through terrain shaping. A well-designed engagement area requires fewer defenders, less ammunition, and less reaction time than a linear defense that tries to be strong everywhere. The terrain does the work. Gravity -- literal and metaphorical -- does the work. This is the origin of the Toboggan Doctrine. In AI agent governance, the "enemy" is not the agent. The enemy is entropy -- the natural tendency of autonomous agents to drift from intent, hallucinate intermediate results, skip preparation steps, and produce outputs that require human correction. Every guardrail-based governance system fights entropy by adding enforcement after the agent has already drifted. Every hook, every policy gate, every runtime interception says: "You went the wrong way. Go back." The toboggan says: "There is only one way to go. Downhill. Through the channel we built." A template that pre-populates the correct frontmatter fields means the agent never faces the decision of what fields to include. A task file that carries the mission statement means the agent never needs to reconstruct intent from scratch. A command channel that specifies "load task file, update session file, claim task, execute, institutionalize" means the agent follows the sequence because it is the obvious path -- not because a hook blocks the alternative. The engagement area analogy holds precisely: shape the terrain so the desired path is the easiest path. When the agent flows through the channel because the template makes it obvious, no enforcement mechanism needs to fire. The hook stands down. The wall is never tested. The system is both more permissive and more reliable, because the conditions that would trigger enforcement never arise. --- ## 3. THE GRAVITY-FED PIPELINE The Toboggan Doctrine operationalizes through a gravity-fed pipeline -- a governance lifecycle where preparation at the top creates momentum that carries agents through execution with minimal friction. ### 3.1 Agents Enter Heavy Military units do not deploy light. A rifle company moves to the line of departure with ammunition, water, communications equipment, night vision, medical supplies, pre-mission intelligence, and rehearsed battle drills. The preparation IS the force multiplier. Under-prepared units hit every obstacle. Over-prepared units flow through them. The gravity pipeline applies the same principle. Before an agent touches a file, it is loaded with: - **OODA orientation:** Full observation of the operational picture -- what changed since the last session, what is the current vault state, what are sibling sessions doing. - **Mission Analysis:** Formal restatement of the mission, assessment of available assets, identification of essential questions, risk assessment. For complex tasks, full MDMP. - **360 Research:** Multi-dimensional environmental scan covering prior work, conflicts, framework integration, mitigations, external best practices, and behavioral impact. - **Knowledge wells:** Domain-specific reference material positioned at known locations in the vault, consumed by agents as they pass through. - **Template selection:** The template carries institutional knowledge. Decisions are pre-made. The agent's job is to fill the template with task-specific content, not to reinvent the decision framework. This preparation is not overhead. It is the mechanism by which downstream gates turn green instead of red. A pre-loaded agent hits checkpoints and passes through. An under-prepared agent hits checkpoints and gets blocked, backtracks, wastes cycles, and burns context window on reconstruction that should have happened upstream. The data supports this. In the PARA vault's email pipeline (T-624), three sessions executed increasingly mature versions of the same workflow. The proof-of-concept session achieved 98.5% first-pass yield on 70 messages. The production session achieved 100% first-pass yield on 210 messages. The difference was not a better model or more guardrails. It was a better template -- version 2.0 carried preservation policies, extraction validation criteria, and chain-of-custody rules that version 1.0 left to agent judgment.[^10] The template-as-channel metaphor has a precise formal analog. Shannon (1948) defines channel capacity C = B log₂(1 + S/N).[^17] A template increases effective bandwidth by pre-encoding decisions and reduces noise by eliminating ambiguous choice points. H(action|template) ≈ 0 vs. H(action|no template) >> 0. A well-designed template converts a high-entropy action space into a near-zero-entropy decision problem. The agent does not decide — it executes. ### 3.2 Gravity Through Gates Gates in the gravity pipeline are not walls. They are checkpoints that confirm the agent is still in the channel. The distinction matters operationally. A wall says "STOP -- you may not proceed." A checkpoint says "Confirm status -- are you carrying what you need?" A wall requires the agent to reverse direction, diagnose what went wrong, and try again. A checkpoint either confirms passage (agent is prepared, green light) or provides a nudge back into the channel (agent is missing something, here is what and where to find it). The PARA vault implements this through two gate types: **Gate A (pre-execution)** verifies that Mission Analysis is complete, the tool inventory has been scanned, the validation method is defined, and the deliverable location is routed. For Tier 1 (routine) tasks, this is an 18-item checklist that takes 30 seconds. For Tier 2 (complex) tasks, it includes full MDMP with backwards planning from the end state. **Gate B (post-execution)** verifies that deliverables exist at claimed destinations, old-behavior documentation has been updated, new code paths are instrumented, and the project index reflects completion. Gate B also enforces institutionalization -- the requirement that lessons learned from this task feed back into the templates and skills that future agents will consume. The gravity pipeline transformed the vault's MA enforcement from a deny-mode hook (blocks the agent entirely if Mission Analysis is not detected) to a canary-mode channel (the template auto-populates MA content when the agent claims a task, and the hook logs rather than blocks if the fields are empty). The result: the same compliance outcome with less friction, because the channel makes compliance the default path rather than the enforced path. ### 3.3 AAR at the Bottom Military operations end with an After-Action Review. Not because doctrine requires it. Because the operation naturally produces the data that the AAR needs. The patrol returns, the leadership assembles, the timeline is reconstructed, the delta between plan and reality is assessed, and corrective actions are assigned. In the gravity pipeline, AAR is the natural terminal point of every task cycle. The agent has executed. The deliverables exist. The git history records what actually happened. The session file records what was planned. The delta between the two IS the AAR. No additional data collection is required. The system's own artifacts provide the evidence. The PARA vault's AAR coverage tells a revealing story about governance maturity: 7% of tasks receive a formal, facilitated AAR. 75% receive a micro-AAR (a one-paragraph assessment at task close). The remaining 18% receive no assessment at all. The formal AARs produce the highest-value lessons -- but they cost the most in execution time. The micro-AARs produce lower-value but higher-volume lessons. The optimal AAR strategy is not "more formal AARs" -- it is better templates that extract maximum insight at minimum cost. This is the toboggan pattern applied to learning itself: make the right assessment the easy assessment. ### 3.4 CPI Loop Back Up The gravity pipeline is not a one-way trip. Each cycle feeds improvements back to the top. Lessons learned during execution become template modifications. A lesson that says "agents skip the extraction validation step" becomes a template field that says "extraction validation: [REQUIRED -- list validated items]." A lesson that says "agents hallucinate frontmatter fields" becomes a template with pre-populated frontmatter that the agent modifies rather than generates. A lesson that says "the hook fired 47 times last month on the same false positive" becomes a hook retirement recommendation. This is the DMAIC cycle applied to governance itself: - **Define:** What governance gap did this task cycle reveal? - **Measure:** How many times did the gap produce a defect? What was the defect rate? - **Analyze:** Is the root cause upstream (template gap), midstream (agent behavior), or downstream (verification gap)? - **Improve:** Update the template, skill, or channel specification. - **Control:** Monitor the next cycle for recurrence. If the defect rate drops to zero, the improvement is stable. If the hook that catches this defect has not fired in 30 days, it is a candidate for retirement. Each AAR finding adjusts the template (policy) in the direction of lower defect rate. The loss function is defect rate; the policy is the template; the gradient is the AAR delta — the same structure as a policy gradient update in reinforcement learning.[^19] The vault's evidence validates a convergence rate of approximately r ≈ 0.10 per cycle: σₙ = σ₀ · (1-r)ⁿ. After ten cycles of disciplined CPI, a governance gap that produced defects at a 10% rate in cycle one produces defects at a 3.5% rate — not through model improvement, but through template improvement alone. The gravity pipeline's self-improving property has a formal analog: a system is Lyapunov stable if there exists V(x) ≥ 0 with dV/dt ≤ 0. The vault's defect rate plays the role of V(x). The CPI loop is the mechanism that keeps dV/dt ≤ 0 — each cycle either reduces the defect rate or holds it constant. The system is provably stable under the CPI loop because the loop's objective function (reduce defects) is monotone decreasing by design. This is how the system improves itself. Not through more enforcement. Through better channels that make enforcement unnecessary. --- ## 4. GPL: THE GOVERNANCE PROCESS LIFECYCLE The Toboggan Doctrine instantiates through a six-phase lifecycle that governs every task from inception through institutionalization. ### Figure 1: The Governance Process Lifecycle ```mermaid %%{init: {"theme": "base", "themeVariables": {"darkMode": true, "background": "#0f172a", "mainBkg": "#1e3a8a", "nodeBorder": "#1e3a8a", "clusterBkg": "#1e293b", "clusterBorder": "#334155", "titleColor": "#f8fafc", "primaryColor": "#1e3a8a", "primaryTextColor": "#f8fafc", "primaryBorderColor": "#1e3a8a", "lineColor": "#6b7280", "edgeLabelBackground": "#1e293b"}}}%% flowchart LR classDef primary fill:#1E3A8A,stroke:#1E3A8A,color:#FFFFFF,stroke-width:2px classDef accent fill:#D97706,stroke:#D97706,color:#FFFFFF,stroke-width:2px classDef success fill:#059669,stroke:#059669,color:#FFFFFF,stroke-width:3px classDef muted fill:#6B7280,stroke:#6B7280,color:#FFFFFF,stroke-width:1px classDef default fill:#334155,stroke:#6B7280,color:#f8fafc,stroke-width:1px PH0[Phase 0 - Template Design] PH1[Phase 1 - Mission Entry] PH2[Phase 2 - Execution] PH3[Phase 3 - Quality Gates] PH4[Phase 4 - Completion and AAR] PH5[Phase 5 - Institutionalization] PH6[Phase 6 - Trust Calibration] GRAVITY[Gravity - forward pass] CPI[CPI Loop - template refined] PH0 -->|Mission loaded| PH1 PH1 -->|Agent enters heavy| PH2 PH2 -->|Gate checkpoints| PH3 PH3 -->|Pass or fail| PH4 PH4 -->|Lessons captured| PH5 PH5 -->|Evidence accumulates| PH6 PH6 -->|Trust recalibrated - template refined| PH0 GRAVITY -.->|downstream| PH3 CPI -.->|closes loop| PH0 class PH0,PH1,PH2,PH3,PH4,PH5 primary class PH6 primary class GRAVITY accent class CPI success ``` *Figure 1: The 7-phase Governance Process Lifecycle. Phases 0-4 are the forward pass - gravity-fed execution. Phase 5 institutionalizes lessons via yokoten. Phase 6 recalibrates trust, feeding back to Phase 0 for template refinement -- closing the CPI loop that makes the system self-improving.* ### Phase 0: Template Design (The Channel) Every recurring task type gets a template. The template carries institutional knowledge -- decisions that have already been made, fields that must be populated, sequences that must be followed, and escape routes for when the agent is stuck. Template design is the highest-leverage activity in the governance lifecycle. A well-designed template eliminates entire categories of agent error. The PARA vault's email processing template (v2.0) carries 387 lines of embedded doctrine: preservation policies for legal chains, extraction validation criteria, chain-of-custody rules, success metrics, and a Phase 0 doctrine check that verifies the agent has read the current SOP before proceeding. An agent entering this template does not need to reason about email governance. The template has already reasoned. The agent executes. The design principle: **templates resolve ambiguity under adversity and time pressure.** They are pilot checklists, not aircraft manuals. Doctrine lives in knowledge wells for depth. Decisions live in templates for speed. A template that demands content independently of Mission Analysis produces agents that stub fields with "TBD" to rush through. A template that captures MA output -- because MA is structurally enforced upstream -- produces agents born with the thinking already done. Template-driven channels are poka-yoke devices — they make errors structurally impossible rather than relying on operator vigilance.[^18] The poka-yoke principle, derived from Toyota Production System, holds that the highest-reliability processes prevent defects through design rather than catching them through inspection. A template that pre-populates frontmatter fields does not rely on the agent remembering to include them. The fields are already there. The agent fills them or leaves them — the structure makes omission visible. ### Phase 1: Mission Entry (Agents Enter Heavy) The agent receives the task, loads the template, and enters the gravity pipeline loaded with preparation. OODA orientation, Mission Analysis, 360 Research, knowledge well loading, and armament checklist verification all happen before the first file is touched. The two-response rule enforces this structurally: Mission Analysis completes in Response N. Agent deployment appears in Response N+1 or later. Analysis written after agents deploy is rationalization, not analysis. This is one of the few hard gates that survives the transition from wall-based to channel-based governance, because the cost of deploying unprepared agents compounds across every downstream task. ### Phase 2: Execution (Gravity-Fed Through Template) Agents execute within the channel defined by the template. The template specifies inputs, outputs, constraints, escape routes, and verification criteria. The agent's degrees of freedom are bounded by the template -- not by hooks that intercept individual actions, but by a channel that makes the correct sequence the obvious sequence. Parallel execution follows military Warning Order doctrine: while the primary agent executes, pre-positioned specialists at pipeline points (knowledge wells, inbox drops, quality reviewers) are already staged and ready. The T-626 skill audit demonstrated this at scale: 7 research agents ran in parallel for the 360 scan, followed by 4 specialist agents (LSS-BB, QASA, ASS2, Doctrine) running in parallel for the PAT review. Eleven agents, one task, zero coordination conflicts -- because the channel defined who does what, when, and where the outputs go.[^11] ### Phase 3: Quality Gates (Checkpoints, Not Walls) Gates A and B bracket execution. Between them, the agent operates with maximum autonomy within the template's channel. The gates verify preparation (A) and completion (B) without micromanaging execution. Gate B enforces institutionalization as a blocking requirement. A task is not complete until its lessons have been captured, its template improvements have been documented, and its downstream references have been updated. This is the CPI loop's entry point -- the mechanism by which each task cycle leaves the system better than it found it. The vault's T-626 skill audit produced a governance artifact that illustrates this: a risk-tier classification system (L0-L3) adapted from OWASP's framework, with a five-criteria review process (doctrine alignment, framework integration, decision loop preservation, agent governance, output quality) and a promotion pipeline from sandbox to production. This artifact was born from a single task's Gate B institutionalization requirement. It now governs all future skill adoption. One cycle improved the system permanently. ### Phase 4: Completion + AAR (Natural, Not Imposed) Task completion produces the AAR naturally. The agent reports what was achieved against what was planned. The delta is assessed. The root cause of any gap is identified -- and critically, the fix is categorized: 1. **IMMEDIATE** (behavioral rule, wording fix): Implement now. Do not register a task. 2. **STRUCTURAL-THIS-SESSION** (hook edit, script change): Implement now. Do not defer. 3. **NEEDS-AUTH** (CLAUDE.md change, architectural): Register a task and document the exact proposed change. 4. **OUT-OF-SCOPE** (external dependency): Register a task and explain the blocker. Task registration is valid only for categories 3-4. For categories 1-2, deferral equals decay. A lesson documented but not acted on is an observation, not a lesson. ### Phase 5: Institutionalization (CPI Loop) This is the phase most governance frameworks omit entirely. The LSS-BB audit of 25 skills found that 80% lacked CPI feedback loops -- they were open-loop processes where defects caught during execution were never aggregated, analyzed, or fed back into process design.[^12] The Toboggan Doctrine treats institutionalization as a blocking gate. The end state is not "deliverables shipped." The end state is "change propagated with zero drift." That means: template updated, skill modified, knowledge well enriched, memory note written, stale references scanned and corrected, downstream consumers notified. Every improvement either lands in a template (so the next agent inherits it) or in a knowledge well (so the next researcher finds it). Nothing evaporates between sessions. The institutionalization requirement is yokoten — systematic propagation of improvement horizontally across all templates and processes that share the same pattern.[^20] A lesson learned in the email pipeline applies to the inbox triage pipeline and the task processing pipeline. Yokoten prevents the common failure mode where a fix is implemented in one process and not propagated to its analogs. The system learns once; the lesson applies everywhere. ### Phase 6: Trust Calibration (Retire the Walls) This is the phase no existing framework addresses. When do you remove guardrails? The Toboggan Doctrine provides a metric-based answer: if a hook has not caught a real error in 30 days, it is overhead. If a template has achieved consistent first-pass yield above 98% for three consecutive cycles, the enforcement mechanisms protecting that template's domain are candidates for retirement or downgrade from deny to canary. Trust calibration is the governance lifecycle's maturity indicator. A system that only adds enforcement is a system that does not trust its own improvements. A system that measures hook fire rates, tracks false positive ratios, and retires enforcement that no longer fires is a system that treats governance as a calibration problem, not a coverage problem. --- ## 5. EVIDENCE: 270 SESSIONS OF EMPIRICAL DATA The Toboggan Doctrine is not a thought experiment. It was extracted from the operational record of a PARA-method Obsidian vault running continuous multi-agent AI operations since January 2026. ### 5.1 Scale of Operations | Metric | Value | Source | |--------|-------|--------| | Completed sessions | 270 | `1-AREAS/Claude-Sessions/Completed/` | | Registered tasks | 498 | `Tasks/Active/` + `Tasks/Completed/` | | Git commits | 8,008 | `git log --oneline` | | Lessons learned entries | 398 (LL + PL) | 14 shard files in `2-RESOURCES/Lessons-Learned/` | | Vault file count | 5,190 .md files | Filesystem scan | | Observation period | 75 days | January 20 -- April 5, 2026 | | Peak daily commit rate | 350 | Morale Board (March 14, 2026) | | Average daily commits | 120 | Morale Board weekly average | These are not proof-of-concept numbers. This is a production system that has been operating continuously for over two months with multiple concurrent AI sessions, cross-session coordination, and real deliverables (published papers, operational email management, financial reconciliation, DARPA proposal support). ### 5.2 Case Study: T-624 Email Pipeline The email pipeline is the cleanest demonstration of the toboggan in production. **Problem:** Process 210+ Gmail messages through categorization, extraction, archival, and action routing with zero chain breaks on legal correspondence and zero compliance violations. **Approach:** Three sessions iterated on the pipeline: | Session | Phase | Result | |---------|-------|--------| | oscar (2026-04-01) | POC | 70 messages, 98.5% FPY, 4 LL entries | | bora (2026-04-04) | Execution | 210 messages, 100% FPY, 3 hledger transactions extracted | | shoat (2026-04-05) | Closure | Institutionalization, QASA verification, T-630 subsumed | The production session achieved 100% first-pass yield. Not through better prompting. Through a better template. Version 2.0 of the email processing template carried preservation policies, extraction validation, and chain-of-custody rules that version 1.0 left to agent judgment. The template made the right decision the default decision. The agent never reached the point where an incorrect categorization was possible, because the template's structure channeled every message through the correct classification logic. One user correction was noted across the entire production run (extraction deferral for a complex case). AAR grade: T (to standard). ### 5.3 Case Study: T-626 Skill Audit The skill audit demonstrated governance at scale across multiple agents. **Scope:** 25 plugin-loaded skills audited across 4 specialist lenses (Lean Six Sigma Black Belt, Quality Assurance Specialist, Advanced Surveillance Security Specialist, Doctrine SME). **Execution:** 11 agents deployed in two waves -- 7 research agents for 360 scan, then 4 PAT specialists for independent grading. **Findings:** - 11 skills graded A (KEEP): no changes needed - 8 skills graded B (ADAPT): specific modifications per skill - 5 skills graded C (SANDBOX): use only with external guardrails - 1 skill graded F (REPLACE): doctrine-violating OODA collapse vector **Systemic finding:** 80% of skills lacked CPI feedback loops. They were open-loop processes -- defects detected but never aggregated or fed back. This validated the Toboggan Doctrine's emphasis on Phase 5 (Institutionalization) as a blocking gate. **Governance artifact produced:** A risk-tier classification system (L0-L3) with adoption pipeline, 5 review criteria, promotion/demotion criteria, and quarterly re-vetting schedule. This artifact now governs all skill adoption in the vault -- born from a single task's institutionalization requirement. ### 5.4 The Trust Calibration Problem in Practice The vault's 398 lessons learned entries tell a story about governance accumulation. Each entry traces to a real failure. Each enforcement mechanism (hook, rule, gate, behavioral instruction) was justified by a real incident. Individually, every guardrail is warranted. Collectively, they produce friction that exceeds their prevention value. The vault's MA enforcement hook was built because Claude skipped Mission Analysis three times in early operations (LL-249). The hook used deny mode -- it blocked Claude entirely if MA markers were not detected. This was appropriate when the behavior was unreliable. Three months later, after 270 sessions, Claude's current model (Opus 4.6) naturally performs OODA orientation on session start. The hook enforces behavior that is already present. The wall blocks a path the agent no longer walks. The Gravity Pipeline Design Spec formalized the solution: transform Gate 1 from deny (wall) to allow-with-log (canary). The hook reads the session file's mission and tier fields instead of checking for ephemeral temp markers. The task claim process auto-populates those fields from the task file. The channel makes compliance automatic. The hook becomes a canary that logs anomalies rather than a wall that blocks progress. This is trust calibration in practice. The system earned trust through 270 sessions of measurable compliance. The enforcement mechanism adapted to match the evidence. --- ## 6. THE TRUST CALIBRATION PROBLEM When do you remove guardrails? This is the question that no existing AI governance framework answers, because every framework is designed to add enforcement, not retire it. OWASP's Agentic Top 10 catalogs risks. Microsoft's Agent Governance Toolkit provides enforcement mechanisms. Both assume that the right number of guardrails is "more than you currently have." The Toboggan Doctrine provides a different answer: the right number of guardrails is the minimum number required to keep the agent in the channel, given the current evidence of agent behavior. That number should decrease over time as templates improve, as agents mature, and as the CPI loop feeds lessons back into the governance architecture. ### 6.1 The Accumulation Problem Every lesson learned produces a fix. Every fix produces an enforcement point. Over 398 lessons, those enforcement points accumulate into a system where: - 14 shard files contain detailed incident records - Hooks fire on tool use, agent deployment, session close, and file operations - Rules files load behavioral instructions into every session - Skills carry inline doctrine, gate references, and escape route guidance - Templates carry 300+ lines of embedded governance per recurring task type Individually justified. Collectively, a drag coefficient. The PARA vault's friction review identified this pattern: hooks built to catch real failures accumulated to the point where their aggregate drag exceeded their prevention value. Not because any single hook was wrong. Because the system lacked a mechanism for retiring hooks whose conditions no longer arise. ### 6.2 The Metric The Toboggan Doctrine establishes a retirement metric: **If a hook has not caught a real error (true positive) in 30 days of continuous operation, it is a candidate for retirement or downgrade.** "Retirement" does not mean deletion. It means transition from enforcement to telemetry. The hook moves from deny (blocks the agent) to canary (logs the event, allows the agent to proceed). If the canary logs zero events over another 30-day period, the hook is fully retired. If the canary catches a real error, the hook is restored to enforcement mode. This is graduated trust, calibrated by evidence. The same principle the military applies to mission command: commanders delegate authority to subordinates who have demonstrated competence, retain authority over subordinates who have not, and adjust delegation continuously as evidence accumulates. The trust accumulation can be formalized as a running estimator: T(t) = T₀ + α · Σ(successes/trials). When T(t) exceeds a retirement threshold T_retire, the hook transitions DENY → CANARY → RETIRED. The threshold T_retire is set by governance policy, not guesswork — empirically derived from the distribution of true positive catch rates across the hook population. Hooks with T(t) < T_retire remain in enforcement. Hooks with T(t) > T_retire are candidates for retirement, pending user authorization. The exploration-exploitation framing applies directly: retaining a deny-mode hook is pure exploitation of a known safe policy. Retiring it is exploration — accepting the risk of a missed error in exchange for reduced friction. The 30-day evidence threshold is a formal exploitation-exploration balance criterion derived from the vault's operational tempo (approximately 10 tasks per day, giving 300 task-execution observations per month — sufficient statistical basis for retirement decisions).[^21] ### 6.3 The Model Improvement Factor There is a variable that most governance frameworks ignore: the models are getting better. Claude Opus 4.6 naturally performs OODA-style orientation on session start. It naturally identifies task dependencies, scans for related work, and asks clarifying questions before executing. These behaviors were not present in earlier models -- they were precisely the behaviors that hooks were built to enforce. Earlier model versions exhibited bounded rationality in the sense Herbert Simon defined: cognitive constraints caused agents to skip Mission Analysis because the overhead of formal analysis exceeded their effective planning horizon.[^22] Hooks were designed for bounded-rational agents and become overhead when agent rationality expands. When the model improves to the point where it naturally exhibits the behavior a hook was designed to enforce, the hook becomes overhead. It enforces behavior that is already present. The wall protects a path the agent no longer walks. Template-driven governance adapts to this automatically. A template that channels agent behavior does not care whether the agent would have made the right decision without the template. The channel works regardless. But hooks that block incorrect decisions become unnecessary when the agent no longer makes those decisions. The toboggan design is inherently more future-proof, because it does not depend on the agent being unreliable. --- ## 7. COMPARISON WITH EXISTING FRAMEWORKS The Toboggan Doctrine does not replace existing AI governance frameworks. It inverts their assumption about where governance should live. ### 7.1 OWASP Agentic Top 10 OWASP's framework catalogs ten risk categories for autonomous agents: excessive agency, prompt injection, insecure tool use, inadequate sandboxing, improper error handling, uncontrolled autonomy, cascading hallucinations, trust boundary violations, logging failures, and supply chain vulnerabilities.[^13] **Compatibility:** Full. The Toboggan Doctrine addresses all ten categories -- but through channel design rather than runtime interception. Excessive agency is prevented by template scope (the agent operates within the template's channel). Cascading hallucinations are prevented by preparation quality (agents enter heavy, so intermediate results are grounded in retrieved evidence rather than generated from nothing). Trust boundary violations are prevented by folder-centric architecture (each project folder carries its own CLAUDE.md that defines scope and constraints for any agent entering it). **Distinction:** OWASP catalogs risks. The Toboggan Doctrine provides a lifecycle for reducing those risks over time through CPI. A risk that appears in OWASP's catalog is a problem to be solved, not a permanent condition to be managed. ### 7.2 Microsoft Agent Governance Toolkit Microsoft's toolkit provides sub-millisecond policy enforcement through Agent OS, execution rings through Agent Runtime, and service reliability engineering through Agent SRE.[^14] **Compatibility:** High. The toolkit's execution rings map to the Toboggan Doctrine's gate tiers (deny for catastrophic/irreversible actions, canary for behavioral drift). The trust scoring system (0-1000 across five behavioral tiers) is a quantified version of the Toboggan Doctrine's trust calibration. **Distinction:** Microsoft's toolkit is a runtime enforcement layer. The Toboggan Doctrine is a lifecycle design philosophy. They operate at different levels of abstraction. An organization could deploy Microsoft's toolkit for runtime enforcement while using the Toboggan Doctrine for governance lifecycle design -- the toolkit enforces, the doctrine determines what needs enforcing and when enforcement can be retired. ### 7.3 Military Mission Command Mission command is the exercise of authority and direction by the commander using mission orders to enable disciplined initiative within the commander's intent.[^15] **Foundation:** The Toboggan Doctrine is built on mission command. The template carries the commander's intent. The channel defines the acceptable boundaries of initiative. The agent operates within those boundaries with maximum autonomy. The gate system verifies that execution aligns with intent without micromanaging the execution itself. The two-response rule (MA completes before agents deploy) directly implements the military principle that subordinate commanders receive the commander's intent before they receive freedom of action. The armament checklist (pre-deployment verification that agents carry the right knowledge wells, tools, and constraints) implements the military principle that units do not cross the line of departure without a pre-combat inspection. ### 7.4 Lean Six Sigma DMAIC DMAIC provides the improvement cycle that the Toboggan Doctrine's CPI loop instantiates.[^16] **Integration:** The governance lifecycle's Phase 5 (Institutionalization) IS the DMAIC Control phase. Every task cycle runs a micro-DMAIC: Define (mission analysis), Measure (execution metrics), Analyze (AAR delta), Improve (template modification), Control (Gate B institutionalization requirement). The CPI loop feeds improvements from each cycle's Control phase into the next cycle's Define phase. The vault's systematic-debugging skill received an A grade across all four specialist lenses in the T-626 audit specifically because it implements DMAIC most faithfully -- with a 3-fix architectural escalation rule that mirrors the Toboggan Doctrine's trust calibration: after three behavioral fixes for the same issue, the fix escalates from behavioral to structural. ### 7.5 Traditional Prompt Engineering **Insufficient.** Prompt engineering optimizes individual agent interactions. The Toboggan Doctrine governs agent lifecycles. A well-engineered prompt produces a better single response. A well-designed template produces better responses across every agent that enters the channel. Prompt engineering is a point optimization. The Toboggan Doctrine is a system optimization. The distinction is measurable. The vault's early sessions relied on prompt engineering to get agents to perform Mission Analysis. This worked sometimes. After the gravity pipeline was implemented -- where the task claim process auto-populates the session file with mission and tier fields extracted from the task file -- MA compliance became automatic. Not because the prompt improved. Because the channel eliminated the decision. --- ## 8. IMPLEMENTATION GUIDE: HOW TO BUILD A TOBOGGAN The Toboggan Doctrine is framework-agnostic. It applies to any system where autonomous AI agents execute tasks within a governance structure. The following guide provides implementation principles, not platform-specific instructions. ### 8.1 Start With the Template, Not the Hooks Identify the most common recurring task types. For each one, design a template that carries: - **Pre-made decisions** that the agent should not have to reason about (formatting standards, output locations, quality criteria, required fields) - **Escape routes** for when the agent is stuck (ambiguous requirements, missing information, multiple valid approaches) - **Verification criteria** that define done (not "complete the task" but "these specific outputs exist at these specific locations with these specific properties") - **CPI hooks** that capture lessons from this execution for the next execution The template should be self-contained enough that any agent -- regardless of prior context -- can read the template, understand the task, and produce a conforming output. This is the folder-centric architecture principle: the intelligence lives in the structure, not the model. A well-structured template makes any model effective. A poorly-structured template makes the best model fumble. ### 8.2 Embed Decisions in the Template Every decision the agent must make is a potential drift point. Every decision pre-made in the template is a drift point eliminated. The email processing template carries 387 lines because every lesson from the proof-of-concept (98.5% FPY) was embedded as a pre-made decision for the production run (100% FPY). The lesson "agents sometimes categorize subscription emails as actionable" became a template rule: "Subscriptions and newsletters: ARCHIVE. Do not flag as actionable unless they contain a time-sensitive deadline." The agent no longer makes this decision. The template made it. ### 8.3 Make the Right Decision the Default Decision If the agent has to actively choose the correct behavior over an easier incorrect behavior, the governance architecture is fighting human nature. Agents, like humans, follow the path of least resistance. Design the channel so the correct path IS the path of least resistance: - Pre-populate frontmatter fields so the agent modifies rather than generates - Sequence template sections in execution order so the agent follows the flow - Position knowledge wells at the points where agents need them, not in a centralized library they have to navigate to - Make the task claim process auto-populate session state so compliance is a byproduct of workflow, not an additional step The behavioral economics literature on choice architecture calls this a "nudge" — structuring the decision environment so the optimal choice is the default choice.[^18] The implementation does not require the agent to be disciplined. It requires the template to be well-designed. ### 8.4 Add Gates Only for Catastrophic and Irreversible Errors Not every risk warrants a deny-mode gate. The Toboggan Doctrine uses a graduated enforcement model: | Error Type | Gate Mode | Example | |-----------|-----------|---------| | Catastrophic + irreversible | DENY | Deploying an execution worker on Tier 2 without OC oversight | | Significant but recoverable | CANARY (log + nudge) | Session file mission field empty | | Minor and self-correcting | TELEMETRY (log only) | Agent uses slightly non-standard formatting | | Template-preventable | NONE (channel handles it) | Agent would skip frontmatter fields | Every gate that is not deny-mode is a channel opportunity. If an error can be prevented through template design, the implementation does not need a gate to catch it. ### 8.5 Measure Hook Fire Rates If the implementation cannot answer "how many times did this hook fire last month, and how many of those were true positives?" then trust calibration is impossible. Instrument every hook with: - Fire count (how often it triggers) - True positive rate (how often it catches a real error vs. a false alarm) - Prevention value (did the hook prevent a downstream defect, or did it block an agent that was going to succeed anyway?) Retirement criteria: zero true positives in 30 days → downgrade to canary. Zero canary logs in 30 days → retire. ### 8.6 Trust the AI More as Evidence Accumulates This is the hardest implementation step, because it requires overcoming the governance instinct to add rather than remove. The evidence from 270 sessions is clear: the model has improved, the templates have matured, and the enforcement mechanisms that were critical in month one are overhead in month three. A governance system that cannot retire its own guardrails is a governance system that will eventually collapse under its own weight -- not from a single failure, but from the accumulated friction of a thousand justified-but-obsolete enforcement points. Trust calibration is not about being reckless. It is about being evidence-based. If the data shows the agent no longer makes the error the hook was built to catch, the hook is no longer serving its purpose. Retire it. If the data is inconclusive, keep it as a canary. If the data shows the agent still makes the error, keep it as a gate. Let the evidence decide. The systems thinking literature calls this a "learning organization" — a system that continuously modifies its own structure based on feedback.[^22] The Toboggan Doctrine operationalizes the learning organization at the governance level: not just learning what to do differently in execution, but learning which governance mechanisms are still necessary and which have been rendered obsolete by organizational maturation. --- ## 9. THE FOLDER-CENTRIC ARCHITECTURE The Toboggan Doctrine's most forward-looking principle is this: **the folder is the product, not the agent.** Agents are ephemeral. They spin up for a task, consume the folder's harness, execute, produce deliverables, and terminate. They are Mr. Meeseeks -- born for a purpose, gone when it is done. The intelligence that persists is not in the model. It is in the folder structure: the CLAUDE.md that defines scope and constraints, the knowledge wells that carry domain expertise, the templates that embed pre-made decisions, the inbox drops that enable inter-agent coordination. This differs fundamentally from the architecture most organizations are building. The dominant pattern is agent-centric: build a sophisticated orchestrator, give it persistent memory, train it on your domain, and trust it to coordinate subordinate agents. This is the COS-commands-army model -- a factory system optimized for assembly lines. The folder-centric model inverts this. The constraint is not agent capability. The constraint is folder readiness. A well-structured folder makes any agent effective. A poorly-structured folder makes the best model fumble. Investment goes into folder architecture, not agent architecture. The implication for governance is profound: instead of building governance around the agent (intercepting its actions, monitoring its decisions, enforcing its compliance), build governance into the folder (templates that carry decisions, knowledge wells that carry context, CLAUDE.md files that carry constraints). When a new agent drops into a governed folder, it inherits the governance automatically. No configuration. No training. No "fine-tuning the agent for your domain." The domain is in the folder. The agent reads it and operates. This is why the Toboggan Doctrine is model-agnostic. The toboggan does not care which model rides it. Claude, GPT, Gemini, Codex -- any model that can read a template, follow a sequence, and produce structured output can operate within a well-designed channel. The governance is in the channel, not the model. --- ## 10. CONCLUSION: BUILD THE CHANNEL The AI governance industry is building walls. Higher walls. Faster walls. Walls with sub-millisecond policy enforcement and five-tier trust scoring and execution rings modeled on CPU privilege levels. The walls are technically impressive. They are also solving the wrong problem. The right problem is not "how do we catch the agent when it goes wrong?" The right problem is "how do we make it so the agent never goes wrong in the first place?" The Toboggan Doctrine answers that question with a governance lifecycle grounded in 270 sessions of empirical evidence: 1. **Design the channel** -- templates that carry institutional knowledge, pre-made decisions, and embedded doctrine 2. **Load the agent** -- OODA, Mission Analysis, 360 Research, knowledge wells, armament checklist 3. **Let gravity work** -- agents flow through the channel because the template makes the right path the obvious path 4. **Verify at gates** -- checkpoints that confirm, not walls that block 5. **Assess naturally** -- AAR produced from the system's own artifacts 6. **Institutionalize relentlessly** -- every lesson feeds back into the templates 7. **Calibrate trust continuously** -- retire enforcement that the evidence no longer supports This is not a theoretical framework. The email pipeline achieved 100% first-pass yield through template-driven governance. The skill audit governed 11 parallel agents through channel design. The MA enforcement transformation replaced a deny-mode wall with a canary-mode channel and achieved the same compliance outcome with less friction. The future of AI governance is not more guardrails. It is better channels. Build the toboggan. Load the agents heavy. Let gravity do the work. Measure the results. Retire the walls. The cats do not need more fences. They need a toboggan. --- ## NOTES [^1]: Gartner, "Predicts 2026: Agentic AI," October 2025. Projects 40% of agentic AI projects canceled by end of 2027. [^2]: Deloitte AI Institute, "State of AI in the Enterprise," 6th Edition, 2025. Survey of 3,235 global leaders; 1 in 5 report mature AI agent governance. [^3]: OWASP, "Top 10 for Agentic Applications for 2026," December 2025. First formal taxonomy of risks specific to autonomous AI agents. Available at: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ [^4]: Microsoft, "Introducing the Agent Governance Toolkit," April 2, 2026. Seven-package, multi-language runtime security system for autonomous AI agents. Available at: https://opensource.microsoft.com/blog/2026/04/02/introducing-the-agent-governance-toolkit-open-source-runtime-security-for-ai-agents/ [^5]: Marshall, J. "The Super Intelligent Five-Year-Old: Why AI Needs Military Doctrine and Lean Six Sigma." Herding Cats in the AI Age, Paper 1. February 2026. [^6]: Marshall, J. "The Digital Battle Staff." Herding Cats in the AI Age, Paper 2. February 2026. [^7]: Marshall, J. "The PARA Experiment: How an Obsidian Vault Became a Multi-Agent Coordination Laboratory." Herding Cats in the AI Age, Paper 3. February 2026. Twelve of fourteen failure modes from UC Berkeley's MAST taxonomy (Cemri et al., 2025, NeurIPS 2025 Spotlight) directly observed and mitigated. [^8]: Marshall, J. "When the AI Stopped Moving Its Own Files: Applying Lean Six Sigma to AI Agent Coordination." Herding Cats in the AI Age, Case Study 1. March 2026. 87% tool call reduction, process sigma 3.2 to 4.6. [^9]: FM 3-90, "Tactics," Chapter 8: Basics of Defensive Operations. U.S. Army. Engagement area development: obstacles channel enemy movement into areas where concentrated fires achieve maximum destruction. Also: Army University Press, "Maximizing Engagement Area Lethality," Military Review, March-April 2022. [^10]: PARA Vault operational record: T-624 Email Operational Framework. Session oscar_d0ad1dc2 (POC, 98.5% FPY), session bora_1b67950a (production, 100% FPY, 210 messages), session shoat_bea32518 (closure and institutionalization). Template v2.0 at `+Templates/Email-Processing-Template.md`. [^11]: PARA Vault operational record: T-626 External Skill & Plugin Audit. Report at `0-PROJECTS/Config-Architecture-Review/T-626-Skill-Audit-Report.md`. 11 agents (7 research + 4 PAT), 25 skills graded, composite grade matrix with worst-grade-dominates synthesis. [^12]: T-626 Skill Audit Report, Top 10 Convergent Findings, #2: "CPI loop absent in 80% of skills (LSS-BB systemic) -- Skills are open-loop: defects caught during review, debugging, and verification are not captured, aggregated, or fed back into process design." [^13]: OWASP, "Top 10 for Agentic Applications for 2026." Risk categories include excessive agency, prompt injection, insecure tool use, inadequate sandboxing, improper error handling, uncontrolled autonomy, cascading hallucinations, trust boundary violations, logging failures, and supply chain vulnerabilities. [^14]: Microsoft Agent Governance Toolkit. Agent OS provides stateless policy enforcement at sub-millisecond latency (p99 < 0.1ms). Agent Runtime provides execution rings modeled on CPU privilege levels. Agent Mesh provides cryptographic identity with Ed25519 signing and dynamic trust scoring (0-1000, five behavioral tiers). GitHub: https://github.com/microsoft/agent-governance-toolkit [^15]: ADP 6-0, "Mission Command: Command and Control of Army Forces." U.S. Army. Mission command enables disciplined initiative within the commander's intent. Also: FM 5-0, "The Operations Process," provides the MDMP framework referenced throughout this paper. [^16]: ASQ, "DMAIC Process: Define, Measure, Analyze, Improve, Control." American Society for Quality. Also: HBR, "How AI Fits into Lean Six Sigma," November 2023, establishing Quality 4.0 as the integration of AI with traditional quality management. [^17]: Shannon, Claude E. "A Mathematical Theory of Communication." *Bell System Technical Journal*, 27(3): 379-423, 1948. Defines channel capacity C = B log₂(1 + S/N) — the maximum rate at which information can be transmitted reliably through a noisy channel. A well-designed template increases effective bandwidth by pre-encoding decision logic and reduces noise by eliminating ambiguous choice points that produce entropy. [^18]: Thaler, R.H., & Sunstein, C.R. (2008). *Nudge: Improving Decisions About Health, Wealth, and Happiness*. Yale University Press. Choice architecture — structuring the decision environment so the optimal choice is the default — is the behavioral economics analog to template-driven channel design. Also: Shingo, S. (1986). *Zero Quality Control: Source Inspection and the Poka-Yoke System*. Productivity Press. Poka-yoke (mistake-proofing) prevents defects through structural design rather than inspection. [^19]: Sutton, R.S., & Barto, A.G. (2018). *Reinforcement Learning: An Introduction*, 2nd ed. MIT Press. Policy gradient methods update a policy π(a|s; θ) in the direction ∇_θ J(θ) that increases expected reward. In the Toboggan framework, the template is the policy, the AAR delta is the gradient signal, and the defect rate is the loss function. Each CPI cycle performs one gradient step. [^20]: Yokoten (横展) is the Toyota Production System term for horizontal knowledge transfer — the systematic propagation of improvement from one process to all analogous processes. Source: Liker, J.K. (2004). *The Toyota Way: 14 Management Principles from the World's Greatest Manufacturer*. McGraw-Hill. Yokoten prevents the "silo learning" failure mode where a fix is institutionalized in one process and not propagated to its analogs. [^21]: Sutton, R.S., & Barto, A.G. (2018). *Reinforcement Learning: An Introduction*, 2nd ed. MIT Press. The exploration-exploitation tradeoff: at 10 tasks/day, 30 days yields ~300 task-execution observations per hook — sufficient to estimate a true positive catch rate with a 95% confidence interval of approximately ±5.6% (binomial, p=0.05, n=300). The 30-day threshold is a principled statistical criterion, not an arbitrary governance rule. [^22]: Simon, H.A. (1996). *The Sciences of the Artificial*, 3rd ed. MIT Press. Bounded rationality: decision-making agents are limited by cognitive constraints that prevent full optimization. Hooks were designed for bounded-rational agents operating near the edge of their effective planning horizon. Also: Senge, P.M. (1990). *The Fifth Discipline: The Art and Practice of the Learning Organization*. Doubleday. A learning organization continuously modifies its structure based on feedback — the Toboggan Doctrine operationalizes this at the governance level. --- *This paper is part of the [Herding Cats in the AI Age](https://herdingcats.ai) series.* *The author's vault, methodology, and operational data are documented in the series' previous papers. All quantitative claims trace to git history, session registries, or task tracking systems maintained in the PARA vault.*