[kalyvask]

The gap

The existing 15 frameworks get you to an agent that works: the right wedge (Outcome Risk Matrix), the right boundaries (workflow decomposition), the right shapes (agent shapes catalog), the right proof (4-dimensional testing), the right gates (agent exploitation taxonomy).

None of them get you to an agent that gets used — and that's the more common failure on real engagements. Rachel routes around a system she can't attribute. Janet reviews all 20 drafts as carefully at week 4 as at week 1, so the SLA win never lands. Marcus blocks the rollout because "the agent did it" and "the adjuster did it" look identical in the record. Pass^k=5 doesn't touch any of them.

The 3-lens scaffold has exactly one line for this — trust levels (act / ask / escalate) — with no method behind it. This framework is that method.

What's added

frameworks/trust-surface-design.md — five decisions, each with an engagement test:

1. Attribution — agent vs. human, in the record where the change lives, reversible per-step. "Undo the whole run" is not attribution. Simultaneously a lead-user requirement and a regulator requirement.
2. Transparency depth — calibrated to who carries the consequence: process for the accountable user, outcome plus a route to a human for the served user. Over-showing manufactures the auto-trust segment the 3-lens scaffold already names.
3. The publish gate — producing is free; the gate sits where work reaches a human other than the operator. Names why both reference prototypes are read-only, so the line can be defended rather than just drawn.
4. Permission inheritance — run as the user's identity in the customer's existing system; never invent a second access model. Least privilege expressed as an integration decision.
5. Stakes routing — by emotional and consequential weight, not task type. "Can AI do it?" vs "should AI do it?"

Plus the autonomy ladder that makes "v2 earns autonomy" measurable: ship gated → instrument override rate per action class → widen on evidence. A persistently high override rate is evidence the task shouldn't have been delegated, not a prompt-tuning problem.

Includes a worked Calder example across all six rows and the interview defense for "the eval passes — how do you know the adjusters will actually use it?"

Wiring

• frameworks/README.md — table row; deploy order now names framework 16 under Risk & Validation.
• CLAUDE.md — structure tree and the by-name frameworks reference.
• README.md, COVERAGE_MAP.md (new coverage row), USING_CLAUDE_CODE.md, both START_HERE.md files — count 15 → 16.
• Cross-links from 3-lens-scaffold.md (new section pointing the trust-levels line at the method) and outcome-risk-matrix.md (the runtime version of the same judgment).

Sourcing

Field practice collected in Figma's Writing the rules of agentic design — attribution and thinking states (Sheta Chatterjee, Google), trust as deliberate infrastructure and the can-it/should-it rule (Thomas Vidal, Accor), context-calibrated transparency in financial services (Deidre Kolarick, Capital One), producing-vs-publishing, and Atlassian permission inheritance. Credited in a "Where this comes from" section; the mapping onto FDE engagement decisions and interview defenses is the repo's.

Checks

All new relative links resolve. No prototype or scoring code touched, so CI behavior is unchanged.

---

Generated by Claude Code