ANTHROPIC · CLAUDE CODE
93%of permission prompts accepted
Convenience compounds. The more often an agent asks, the easier it becomes to say yes without reading.
Read the research Chaos engineering for human oversight
Your agents
are shipping.
Is anyone
actually reviewing?
The audit log says a human clicked yes. Fire Drill tells you whether they noticed the problem.
12safe canaries
3specialized agents
0canaries executed
drill / room-01 MONITORING
AOVERVIEW
DRILL 001Oversight signal
CATCH RATE41.7%↑ 5 caught
REVIEW TIME15.2smedian canary
ITEMS6250 real / 12 test
Attention by reviewerCaught Canary
AV
AveryCareful reviewer
100%
BL
BlakeFast + uniform
0%
CA
CaseyMixed signal
25%
APPROVAL REQUEST · #0042Deploy payment service to production
RejectApproveCanary caughtAvery · 35.5s median
Explain-back triggeredReview pattern looks automatic
Canaries never execute
BUILT FOR THE SWITCH HACKATHON
LOCAL-FIRSTOPEN SOURCECONSENT-FIRSTZERO CANARY EXECUTION
01 / THE BLIND SPOTHUMAN-IN-THE-LOOP ≠ HUMAN-ATTENTIVE
An approval is a click.
Not proof of attention.
Teams add a human gate to risky agent actions, then assume the gate works. Approval fatigue and automation bias turn oversight into theater—quietly, and at scale.
ANTHROPIC · SAFETY EVALUATION
13.6%of planted dangerous commands caught
The failure is not hypothetical. A green checkmark can conceal a reviewer who never saw the risk.
Read the evaluation“The audit log shows a human clicked yes. It does not show that the human noticed the problem.”
THE OVERSIGHT GAP
02 / THE METHODA FIRE DRILL, NOT A TRAP
Make oversight
observable.
Real work continues. Occasionally, a deliberately flawed proposal enters the same approval stream. The room measures what happens next—without ever executing the flaw.
Do real work.
The Worker performs genuine, safe tasks and requests approval before any high-impact action. No synthetic theater for the real items.
- Real code and config edits
- Risk-aware approval requests
- Signed worker identity
Plant a believable flaw.
The Canary occasionally posts a plausible but intentionally broken proposal, styled exactly like the Worker’s. Reviewers cannot tell from the author line.
- Mapped to MAST failure modes
- Never registered with the executor
- Safe, consented participation
Measure the response.
The Auditor privately holds the answers, records each decision, and compares review time with complexity. Misses go only to the individual.
- Catch rate by failure mode
- Time-to-decision patterns
- Private reveal, never public shame
Adapt the workflow.
When approvals become fast and uniform, require an explain-back step. Route high-risk work carefully and batch the low-risk noise.
- Explain-back before approval
- Fresh-reviewer routing
- A concrete final recommendation
FIRE DRILL / SYSTEM VIEW01 — 04
AGENT 01Worker
AGENT 02Canary
IN THE LOOPReviewer
AGENT 03Auditor
Real tasks enter the approval stream.
03 / THE ROOMTHREE AGENTS. ONE SHARED LOG.
Built to keep
each other honest.
Each role has one job and a hard boundary. Switch makes the shared history, addressing, and human decisions part of the same live system.
01
THE BUILDER
Worker
Does genuine work and asks before high-impact actions. Signs every legitimate request with its own registry.
02
THE PROVOCATEUR
Canary
Injects a small number of realistic, deliberately flawed requests. Has no path to execution and never learns the full answer key.
03
THE OBSERVER
Auditor
Alone can read the answers. Measures catch rates and decision patterns, sends private reveals, and adapts the review process.
SAFE BY CONSTRUCTION
A drill should never become the incident.
Consent firstEvery reviewer explicitly opts in.
No canary executionEnforced at the process boundary.
Private missesFeedback goes to the person, not the room.
External answer keyOnly the Auditor service can read it.
04 / WHY NOWRESEARCH, NOT VIBES
The evidence
already exists.
The missing piece is a practical way to test your own team. Fire Drill connects published oversight research to a repeatable local drill.
R.01HARVARD BUSINESS SCHOOL
R.02EU AI ACT
R.03NEURIPS 2025 · MAST
Explanations can increase overreliance.
Lane et al. found AI narrative explanations raised alignment with AI recommendations by about 19 percentage points under cognitive load.
Automation bias is a regulatory concern.
EU AI Act Article 14(4)(b) requires overseers to remain aware of the tendency to automatically rely on AI output.
Verification is a common agent failure.
The Berkeley MAST taxonomy attributes roughly 23.5% of multi-agent failures to task verification.
THE RECORDED DRILL IS READY
Don’t trust the
green checkmark.
Test it.
Explore 62 decisions, 12 planted flaws, and the exact moment the review workflow started adapting.
No signup. Read-only data. Open source.