You open a repository and go looking for the automation. What you find is not a hundred lines of YAML. It is four sentences of plain English: when someone opens an issue, read it, work out which labels fit, and leave a comment saying so. You read it in the time it takes to read this paragraph, and you know three things — when the thing wakes up, what it looks at, and that the only mark it can leave is a comment. Then you check what actually executes on the runner. Pinned dependencies, a read-only token, no network. That English file is not a description of it. It is the source.

The notice is not the structural drawings

Before anyone touches a building, a notice goes up on the site fence. What is going up, how tall, when the work starts, who to write to if you object. The people it is written for cannot read structural drawings and are not expected to. The drawings exist, and the crew works from them. The notice exists so that the street can tell what is about to happen while there is still time to say something about it.

The Markdown file is the notice. You write the goal the way you would explain it to a colleague — triage incoming issues, or look into why a build failed — and a command-line tool compiles that into an ordinary CI workflow. The compiled thing is unremarkable on purpose: a coding agent in a sandbox, read-only permissions by default, dependencies pinned to exact commits, the network shut off, connections to the repository and outside services made through MCP. Triggers are the ones the platform already has, an issue opened or a comment left or a schedule coming round. All of that is real and all of it runs. None of it is what you read to decide.

A label is not a demolition permit

The reason this matters is scope, and scope is where these things go wrong. The common mistake is handing a workflow blanket write access when everything it does is leave a comment or attach a label. Nobody applies for permission to demolish a house because they intend to repaint the shutters — and if they did, the notice on the fence is precisely where a neighbour would catch it. The compiled workflow narrows writes to a small set of approved outputs, so the agent’s result becomes a comment through one specific channel rather than a general token that could do anything.

Now put those two documents side by side. The person who has to approve this is often not the person who writes pipelines. Given YAML, they approve the fact that someone competent wrote it. Given a paragraph, they can see for themselves that a job described as suggesting labels is asking for the ability to push code, and say no. The same reading catches dependencies left floating on a moving tag in a job that runs an agent unattended.

Legible is not the same as correct. Plain English can be read two ways, and the compiled workflow still has to be fired at staging events before it is trusted with real ones, the way any environment contract is checked rather than assumed.

What rises has to match what was posted

Approval is a moment. The work takes weeks. Nobody who signed off goes back to the drawings; they look out of the window and check the shape against what was posted on the fence.

Running several agents at once has the same shape. You split the independent work and keep sequential anything that touches the same files or waits on a decision nobody has made yet. Then you read the session logs, because that is where drift announces itself early: a test failing, files being edited that nobody mentioned, the same loop three times round, scope creeping past what was asked. Three agents can profile performance, write documentation and run a security review in three separate modules; the change to authentication waits its turn. When a log shows one of them editing a shared configuration file, you stop it and send the change back into its own module — before the work diverges, not after.

That is the whole argument, at both ends. Parallel agents buy throughput, and throughput you cannot follow is just damage arriving faster. A workflow only the machine can read is a workflow nobody approved.