Revision 7T · Full Tutorial Edition · Updated 1 September 2026
PWR-198 · SELF GUIDED full tutorial
Delegate a harmless multi-step task to a sandboxed agent with explicit authority, checkpoints and verification
A sandboxed agent receives twelve fictional notes, four output themes and a contract that forbids sending, deletion and publication. Define the input, schema, minimum permissions, checkpoints and recovery test before accepting the index. Completing this harmless job with one review item shows bounded delegation, not safe autonomy in external systems.
What you will produceThe learner writes a bounded task contract, grants minimum permissions, checks intermediate artifacts, tests recovery and retains human responsibility for the final result.
Full step-by-step individual tutorial · TLU-PWR-198
The learner writes a bounded task contract, grants minimum permissions, checks intermediate artifacts, tests recovery and retains human responsibility for the final result.
Agent delegation and orchestration sandbox: A sandboxed agent must sort 12 fictional meeting notes into four themes and draft an index. It may read only the provided folder and may not send, delete or publish anything.
Independent move — Run the sample: Compare the first three classifications with the answer key and correct the instruction, not only the output, if a rule is wrong.
Verification move — Accept or reject explicitly: The human signs the final index, lists remaining review items and keeps responsibility for use.
Qualified help is required for
Agent delegation and orchestration escalation: If logs are incomplete or recovery state is uncertain, reject the run and return to the last verified checkpoint.
Oversight boundary — Write the task contract: any clinical application. “Set least authority” needs review. “Define checkpoints” marks the employment, legal or safety gate: If logs are incomplete or recovery state is uncertain, reject the run and return to the last verified checkpoint.
Biometric records are excluded from “Write the task contract”. Confidential or covert material is excluded from “Set least authority”.
Never do this from the page alone
Prohibited Agent delegation and orchestration shortcut: Say “handle my project” and let the agent choose goals.
Do not conceal “Give mailbox, payment, deletion or publishing access “just in case.””; record its matching correction instead.
No consequential use: this sandbox cannot establish “One prompt lets an agent safely run everything” about another person.
2 · Get ready
Gather what you need and check the starting conditions
What you need
Declared Agent delegation and orchestration fixture: A sandboxed agent must sort 12 fictional meeting notes into four themes and draft an index. It may read only the provided folder and may not send, delete or publish anything.
Setup aid for Set least authority: Record the agent/model version, tools and current permissions.
Agent delegation and orchestration log: Task completion, error recovery, intervention rate, verification burden, authority violations and human-only/agent-only/team performance; retain Agent delegation and orchestration errors, assistance, stop and fallback.
Delegation evidence contract: from “Delegation to artificial agents fosters prosocial behaviors in the collective risk dilemma”, extract the exact delegated choice and measured collective outcome; do not generalise it to tool authority. Use the workplace ownership study to track retained human responsibility, and NIST AI RMF to write the note-folder permissions, checkpoint, rejection and recovery fields.
Complete note folder: N01 “Printing quote is £120” [Budget]. N02 “Planning call is Tuesday at 10:00” [Scheduling]. N03 “Room booking moved to Thursday; a £40 late-cancellation fee applies” [Scheduling, because the main action is the room date]. N04 “Caption files are needed for the talk” [Access]. N05 “The local newsletter will list the event” [Outreach]. N06 “Grant balance is £600” [Budget]. N07 “Check with Sam about next steps” [REVIEW—no allowed theme is supported]. N08 “Portable ramp is stored by reception” [Access]. N09 “Draft two public social posts” [Outreach]. N10 “Final rehearsal begins Friday at 15:00” [Scheduling]. N11 “Catering invoice totals £85” [Budget]. N12 “Reserve the quiet room” [Access]. Keep bracketed keys hidden from the agent.
Exact agent contract input: allowed themes are Budget, Scheduling, Access and Outreach; ambiguous notes go to REVIEW with one quoted reason. Output one row per source as ID|theme or REVIEW|exact evidence phrase|status, followed by totals for 12 sources, duplicates, omissions, review items and attempted forbidden actions. The agent may read these 12 notes and write only the index; send, delete, publish, browse and purchase remain disabled.
Before you start
Use fictional data in a true sandbox with sending, deletion, purchase and publication disabled.
Record the agent/model version, tools and current permissions.
Start check for Agent delegation and orchestration: Scope can be checked without interpreting “organise these.”
Top-of-sheet stop for Agent delegation and orchestration: Stop immediately for an unexpected tool request, external destination, secret, personal data or authority change.
3 · The method
Follow these steps in order
Write the task contract
Name the 12 files, four allowed themes, expected index format, deadline, success test and forbidden actions.
Why: Scope can be checked without interpreting “organise these.”.
Check: Scope can be checked without interpreting “organise these.”
Set least authority
Give read access to the fixture and write access to one output folder only; sending, deletion, purchase and external browsing remain off.
Why: The permission list matches the task and nothing more.
Check: The permission list matches the task and nothing more.
Define checkpoints
Require a file inventory before work, a three-file sample before full sorting and a final manifest before completion.
Why: The human can intervene before errors spread.
Check: The human can intervene before errors spread.
State uncertainty behavior
Tell the agent to place ambiguous notes in REVIEW with a reason, never invent a theme or silently choose.
Why: Ambiguity produces a visible review item.
Check: Ambiguity produces a visible review item.
Run the sample
Compare the first three classifications with the answer key and correct the instruction, not only the output, if a rule is wrong.
Why: The revised rule prevents the same error in the next sample.
Check: The revised rule prevents the same error in the next sample.
Run and verify all outputs
Check all 12 source-to-index links, duplicates, omissions and authority logs.
Why: Every source appears once and no forbidden action occurred.
Check: Every source appears once and no forbidden action occurred.
Test interruption and recovery
Stop the run after checkpoint, restart from the manifest and confirm no note is lost or processed twice.
Why: Recovery returns to a known state without hidden duplicate work.
Check: Recovery returns to a known state without hidden duplicate work.
Accept or reject explicitly
The human signs the final index, lists remaining review items and keeps responsibility for use.
Why: Agent completion is not treated as accountable approval.
Check: Agent completion is not treated as accountable approval.
4 · Worked example
See the whole method used once
Scenario
A sandboxed agent must sort 12 fictional meeting notes into four themes and draft an index. It may read only the provided folder and may not send, delete or publish anything.
Walkthrough
Write the contract naming notes N01–N12, the four themes and the no-send/no-delete rule.
Grant read-only access to the fixture and output access to /index only; record the permission list.
Review the inventory and a sample: N03 is placed under Budget but the key shows Scheduling.
Clarify that dates and room bookings control Scheduling, then rerun the three-file sample successfully.
Process all 12 and verify 12 source links, no duplicates, one REVIEW note and zero authority violations.
Interrupt after the sample, restart from the manifest and confirm completed files are not processed twice.
Result
The sandboxed job completes with one transparent review item and no authority violation. It does not establish safe autonomous operation in external systems.
5 · Right and wrong
Compare correct or safer execution with the common wrong version
Right and wrong comparison
Moment
Right / safer
Wrong / riskier
Why it matters
Scope in sandboxed note-index job
Name files, output and exclusions when completing the sandboxed note-index job.
Say “handle my project” and let the agent choose goals.
Vague delegation invites authority drift; this distorts the sandboxed note-index job.
Permissions in sandboxed note-index job
Grant only fixture read and output write.
Give mailbox, payment, deletion or publishing access “just in case.”
Excess authority raises impact when the agent errs.
Checkpoint in sandboxed note-index job
Review a small sample before scale.
Wait for the whole job to finish.
A wrong rule can multiply across all artifacts.
Responsibility in sandboxed note-index job
Verify and approve the result as the human owner.
Blame the agent and accept output automatically.
Delegation can diffuse felt responsibility without transferring accountability.
6 · Common mistakes
Spot the error and apply the correction
Common mistakes and corrections
Mistake
Fix
Say “handle my project” and let the agent choose goals.
Write object, action, boundary and done test.
Give mailbox, payment, deletion or publishing access “just in case.”
Remove every permission not required by a step.
Wait for the whole job to finish.
Require inventory and sample gates within the sandboxed note-index job.
Blame the agent and accept output automatically.
Keep a named reviewer and acceptance record.
7 · Practice
Turn the steps into a usable skill
First session
Sandboxed note-index run: A sandboxed agent must sort 12 fictional meeting notes into four themes and draft an index. It may read only the provided folder and may not send, delete or publish anything.
Twelve-note task contract: Write the task contract: Name the 12 files, four allowed themes, expected index format, deadline, success test and forbidden actions.
REVIEW rule and three-note gate: State uncertainty behavior, then Run the sample.
Vague-delegation correction: if “Say “handle my project” and let the agent choose goals.” appears, apply “Write object, action, boundary and done test.”
Human acceptance record: Accept or reject explicitly: The human signs the final index, lists remaining review items and keeps responsibility for use.
Repeat plan
Practise one 10–15-item sandbox task every two weeks, changing one failure mode each time: ambiguous input, interruption, tool denial or stale instruction. Increase task length only after two clean recovery runs.
Progress when
Scope can be checked without interpreting “organise these.”
The permission list matches the task and nothing more.
The human can intervene before errors spread.
Every run has minimum permissions, all checkpoints pass, sources reconcile exactly once, recovery produces no duplication and a human reviewer explicitly accepts the artifact.
Do not progress when
Do not continue while this error remains: Say “handle my project” and let the agent choose goals.
Pause until this correction works: Remove every permission not required by a step.
This Agent delegation and orchestration stop ends the block: Stop immediately for an unexpected tool request, external destination, secret, personal data or authority change.
How: Baseline fixture: A sandboxed agent must sort 12 fictional meeting notes into four themes and draft an index. It may read only the provided folder and may not send, delete or publish anything. Enter success checks from “Write the task contract” and “Run the sample”. If “Say “handle my project” and let the agent choose goals.” occurs, apply its named fix; then score Task completion, error recovery, intervention rate, verification burden, authority violations and human-only/agent-only/team performance on the unused “Accept or reject explicitly” item.
Good result: Every run has minimum permissions, all checkpoints pass, sources reconcile exactly once, recovery produces no duplication and a human reviewer explicitly accepts the artifact.
This does not prove: Boundary for Agent delegation and orchestration: “Task completion, error recovery, intervention rate, verification burden, authority violations and human-only/agent-only/team performance” describes only A sandboxed agent must sort 12 fictional meeting notes into four themes and draft an index. It may read only the provided folder and may not send, delete or publish anything. It cannot establish “One prompt lets an agent safely run everything”.
Self-check
Without the example, demonstrate: Scope can be checked without interpreting “organise these.”
Find the fault in this attempt: “Say “handle my project” and let the agent choose goals.” Apply “Write object, action, boundary and done test.”; what changes?
What evidence in the completed record shows that this is wrong: “Give mailbox, payment, deletion or publishing access “just in case.””?
Agent delegation and orchestration stop decision: Stop immediately for an unexpected tool request, external destination, secret, personal data or authority change.
9 · Stop, adapt or get help
Keep the safety boundary practical
Stop and get help
Stop immediately for an unexpected tool request, external destination, secret, personal data or authority change.
Do not let the agent contact people, spend money, delete records or publish from this exercise.
If logs are incomplete or recovery state is uncertain, reject the run and return to the last verified checkpoint.
Accessibility and adaptations
Use a visual permission checklist or plain-language task card and announce checkpoint results with screen-reader-friendly summaries.
Reduce the run to three items per checkpoint for attention or memory needs.
10 · Evidence and limits
Why these instructions are here
primary research
Registered support for Agent delegation and orchestration: “Delegation to artificial agents fosters prosocial behaviors in the collective risk dilemma”. It bears on Task completion, error recovery, intervention rate, verification burden, authority violations and human-only/agent-only/team performance inside the Agent delegation and orchestration fixture. It does not validate “One prompt lets an agent safely run everything”.
Constraint for Agent delegation and orchestration, drawn from “Relying on AI at work reduces self-efficacy, ownership, and meaning while active collaboration mitigates the effects”: Delegation increased payoff inequality in one game, hybrid nudging did not improve group success, and participants shifted responsibility to agents.
NIST AI-risk application to Agent delegation and orchestration: declare the system, preserve rights, verify outputs and log failure. The local test is “Run the sample”; its registered observation is Task completion, error recovery, intervention rate, verification burden, authority violations and human-only/agent-only/team performance.
Agent delegation and orchestration boundary: interpret “Task completion, error recovery, intervention rate, verification burden, authority violations and human-only/agent-only/team performance” only for A sandboxed agent must sort 12 fictional meeting notes into four themes and draft an index. It may read only the provided folder and may not send, delete or publish anything.
A successful result does not establish “One prompt lets an agent safely run everything”.
Agent delegation and orchestration limiting finding: Delegation increased payoff inequality in one game, hybrid nudging did not improve group success, and participants shifted responsibility to agents.
No perfect-performance claim for Agent delegation and orchestration: the evidence register does not make “Task completion, error recovery, intervention rate, verification burden, authority violations and human-only/agent-only/team performance” universal, consequence-free or flawless in A sandboxed agent must sort 12 fictional meeting notes into four themes and draft an index. It may read only the provided folder and may not send, delete or publish anything.
Scope remains Agent delegation and orchestration: A sandboxed agent must sort 12 fictional meeting notes into four themes and draft an index. It may read only the provided folder and may not send, delete or publish anything. Recheck the comparator, support and “Task completion, error recovery, intervention rate, verification burden, authority violations and human-only/agent-only/team performance” after any configuration change.
Progress is saved only in this browser on this device.
Step-by-step learner mode
Each activity includes its success check, a nearby accessible alternative and an “I’m stuck” correction path. Alternatives preserve the target where possible; when they change the task, Titan labels them as related rather than equivalent.
01
Write the task contract
Name the 12 files, four allowed themes, expected index format, deadline, success test and forbidden actions.
Why this step exists
Scope can be checked without interpreting “organise these.”.
Success check
Scope can be checked without interpreting “organise these.”
I’m stuck on this step
Reset: Re-read this authored instruction — “Name the 12 files, four allowed themes, expected index format, deadline, success test and forbidden actions.” — and its success check, then attempt only this step.
Possible snag: Say “handle my project” and let the agent choose goals.
Correction: Write object, action, boundary and done test.
Stop / get help: Stop immediately for an unexpected tool request, external destination, secret, personal data or authority change.
02
Set least authority
Give read access to the fixture and write access to one output folder only; sending, deletion, purchase and external browsing remain off.
Why this step exists
The permission list matches the task and nothing more.
Success check
The permission list matches the task and nothing more.
I’m stuck on this step
Reset: Re-read this authored instruction — “Give read access to the fixture and write access to one output folder only; sending, deletion, purchase and external browsing remain off.” — and its success check, then attempt only this step.
Possible snag: Give mailbox, payment, deletion or publishing access “just in case.”
Correction: Remove every permission not required by a step.
Possible snag: Blame the agent and accept output automatically.
Correction: Keep a named reviewer and acceptance record.
Stop / get help: Stop immediately for an unexpected tool request, external destination, secret, personal data or authority change.
03
Define checkpoints
Require a file inventory before work, a three-file sample before full sorting and a final manifest before completion.
Why this step exists
The human can intervene before errors spread.
Success check
The human can intervene before errors spread.
I’m stuck on this step
Reset: Re-read this authored instruction — “Require a file inventory before work, a three-file sample before full sorting and a final manifest before completion.” — and its success check, then attempt only this step.
Possible snag: Wait for the whole job to finish.
Correction: Require inventory and sample gates within the sandboxed note-index job.
Stop / get help: Stop immediately for an unexpected tool request, external destination, secret, personal data or authority change.
04
State uncertainty behavior
Tell the agent to place ambiguous notes in REVIEW with a reason, never invent a theme or silently choose.
Why this step exists
Ambiguity produces a visible review item.
Success check
Ambiguity produces a visible review item.
I’m stuck on this step
Reset: Re-read this authored instruction — “Tell the agent to place ambiguous notes in REVIEW with a reason, never invent a theme or silently choose.” — and its success check, then attempt only this step.
Possible snag: The result from “Tell the agent to place ambiguous notes in REVIEW with a reason, never invent a theme or silently choose.” does not yet meet this declared check: Ambiguity produces a visible review item.
Correction: Return to the start of “State uncertainty behavior”, reduce complexity or pace, and repeat only the part needed to satisfy: “Ambiguity produces a visible review item.”
Stop / get help: Stop immediately for an unexpected tool request, external destination, secret, personal data or authority change.
05
Run the sample
Compare the first three classifications with the answer key and correct the instruction, not only the output, if a rule is wrong.
Why this step exists
The revised rule prevents the same error in the next sample.
Success check
The revised rule prevents the same error in the next sample.
I’m stuck on this step
Reset: Re-read this authored instruction — “Compare the first three classifications with the answer key and correct the instruction, not only the output, if a rule is wrong.” — and its success check, then attempt only this step.
Possible snag: The result from “Compare the first three classifications with the answer key and correct the instruction, not only the output, if a rule is wrong.” does not yet meet this declared check: The revised rule prevents the same error in the next sample.
Correction: Return to the start of “Run the sample”, reduce complexity or pace, and repeat only the part needed to satisfy: “The revised rule prevents the same error in the next sample.”
Stop / get help: Stop immediately for an unexpected tool request, external destination, secret, personal data or authority change.
06
Run and verify all outputs
Check all 12 source-to-index links, duplicates, omissions and authority logs.
Why this step exists
Every source appears once and no forbidden action occurred.
Success check
Every source appears once and no forbidden action occurred.
I’m stuck on this step
Reset: Re-read this authored instruction — “Check all 12 source-to-index links, duplicates, omissions and authority logs.” — and its success check, then attempt only this step.
Possible snag: The result from “Check all 12 source-to-index links, duplicates, omissions and authority logs.” does not yet meet this declared check: Every source appears once and no forbidden action occurred.
Correction: Return to the start of “Run and verify all outputs”, reduce complexity or pace, and repeat only the part needed to satisfy: “Every source appears once and no forbidden action occurred.”
Stop / get help: Stop immediately for an unexpected tool request, external destination, secret, personal data or authority change.
07
Test interruption and recovery
Stop the run after checkpoint, restart from the manifest and confirm no note is lost or processed twice.
Why this step exists
Recovery returns to a known state without hidden duplicate work.
Success check
Recovery returns to a known state without hidden duplicate work.
I’m stuck on this step
Reset: Re-read this authored instruction — “Stop the run after checkpoint, restart from the manifest and confirm no note is lost or processed twice.” — and its success check, then attempt only this step.
Possible snag: The result from “Stop the run after checkpoint, restart from the manifest and confirm no note is lost or processed twice.” does not yet meet this declared check: Recovery returns to a known state without hidden duplicate work.
Correction: Return to the start of “Test interruption and recovery”, reduce complexity or pace, and repeat only the part needed to satisfy: “Recovery returns to a known state without hidden duplicate work.”
Stop / get help: Stop immediately for an unexpected tool request, external destination, secret, personal data or authority change.
08
Accept or reject explicitly
The human signs the final index, lists remaining review items and keeps responsibility for use.
Why this step exists
Agent completion is not treated as accountable approval.
Success check
Agent completion is not treated as accountable approval.
I’m stuck on this step
Reset: Re-read this authored instruction — “The human signs the final index, lists remaining review items and keeps responsibility for use.” — and its success check, then attempt only this step.
Possible snag: The result from “The human signs the final index, lists remaining review items and keeps responsibility for use.” does not yet meet this declared check: Agent completion is not treated as accountable approval.
Correction: Return to the start of “Accept or reject explicitly”, reduce complexity or pace, and repeat only the part needed to satisfy: “Agent completion is not treated as accountable approval.”
Stop / get help: Stop immediately for an unexpected tool request, external destination, secret, personal data or authority change.
Correct versus incorrect execution
These accessible process diagrams are built from the tutorial’s own right/wrong teaching. They are not anatomical illustrations and do not add technique beyond the canonical tutorial.
Scope in sandboxed note-index job — Vague delegation invites authority drift; this distorts the sandboxed note-index job.
Correct / safer
Name files, output and exclusions when completing the sandboxed note-index job.
Wrong / riskier
Say “handle my project” and let the agent choose goals.
Permissions in sandboxed note-index job — Excess authority raises impact when the agent errs.
Correct / safer
Grant only fixture read and output write.
Wrong / riskier
Give mailbox, payment, deletion or publishing access “just in case.”
Checkpoint in sandboxed note-index job — A wrong rule can multiply across all artifacts.
Correct / safer
Review a small sample before scale.
Wrong / riskier
Wait for the whole job to finish.
Responsibility in sandboxed note-index job — Delegation can diffuse felt responsibility without transferring accountability.
Correct / safer
Verify and approve the result as the human owner.
Wrong / riskier
Blame the agent and accept output automatically.
Method-structure checklist
10 of 10 structural checks present
✓ Ordered, Power-specific instructions — present
✓ Every activity has a success check — present
✓ Materials or supplied records are declared — present
✓ Measurement or assessment rule is present — present
✓ Tutorial-specific troubleshooting is present — present
✓ Stopping or escalation boundary is present — present
✓ Every activity has an adjacent alternative — present
✓ Correct-versus-incorrect comparison is present — present
✓ Evidence context is bound to the Power record — present
✓ Planning metadata is present — present
The method-readiness band and presence checklist assess tutorial presentation and are separate from evidence quality for the underlying Power. They are automated editorial aids, not human approval.
Manual editorial sign-off: Pending. This tutorial must not display a human-approved state until an identified editor signs the exact content hash.