Skip to main content
In plain terms: Forge’s AI can do a lot of the legwork, but certain decisions always belong to a human. This is built into the structure of the system, not left as a setting someone could turn off.

The three operating principles

Every design choice in Forge maps back to one of three principles:
1

Sources have authority. Every claim cites.

Every document that enters Forge is graded by trust level before it is used. A claim that a rule applies must cite that rule and its version. Nothing the system says is ungrounded.
2

Decisions are first-class objects, not log lines.

Every engineering decision is recorded with the inputs it was made from, the rule version it was made under, the evidence it cited, who made it, and a signature that makes it tamper-evident. When a rule later changes, the system can find every decision that needs re-checking.
3

AI proposes; humans decide; the gate is structural.

The AI can retrieve, compare, draft, flag, and propose. It cannot be the design authority. Decisions touching class, USCG, or safety always pass through a human approval gate. This is not a setting that can be disabled.

What humans always own

The system is intentionally designed so that humans remain authoritative on:

Class and USCG decisions

Every class-touching or USCG-touching decision requires human approval at the final gate, by structure.

The shape of what's known

Every change to the underlying model of what kinds of things exist is governed by humans, never by the AI.

What the AI may do

Every change to the catalog of allowed AI moves goes through a review checklist before it ships.

Unsure outputs

Whenever the AI is low-confidence or abstains, the system surfaces the question and a human answers it.

Production readiness

Every sign-off that a build is ready for production is a human decision.

Abstention is a feature, not a bug

A key part of keeping humans in control is that the AI is built to stop when it is unsure. is treated as a quality behavior. If the AI cannot find the evidence it needs, it asks for more rather than guessing. The system is held to a high bar for doing this well (a target of better than 98%). The result is an AI that is boxable, auditable, and reversible. If a behavior turns out to be wrong, it gets rolled back like any other versioned software change, never patched on the fly. For the full list of limits, see What Forge Will Not Do.