Multi-agent AI systems that people can check

What is the banco, and how big is it?

Banco is Italian for workbench. It is a private git repository where only live work sits; everything finished goes to an archive. On 8 November 2026 it held 287 project folders, 118 of them software and AI tooling, and 152 skills: written procedures that an agent loads only when the task needs them. These count folders and instructions in my own workbench, not products shipped or people trained.

Every project is a deliverable that can be closed, not an area of interest. Each one opens with the same file: scope, deliverable, when it counts as done, what it must not do, and what lives outside git. Opening, closing, renaming or reopening a project is done by a script, which writes a line in a ledger. Nobody declares a status: a view called /now computes it from recent file changes and git history. Closing is easy on purpose. Clutter is the enemy.

How is the work divided among the models?

One model directs, others carry out the tasks. The harness is Claude Code. The director is Claude Opus; well-specified tasks go to subagents on Claude Sonnet; Claude Fable is called only for the hard piece, and only if it passes a written gate. Engines from other vendors (OpenAI through Codex, Google Gemini, xAI Grok, Zhipu GLM, Moonshot Kimi) run as separate headless processes, never as a quiet substitute inside the director's session.

On drafts, models from competing vendors work on the same artefact: one drafts, the others challenge it, and I build the final version from what holds up. The ideas, the style and the final say stay mine.

The routing rule is one sentence: send each task to the cheapest model that does it to the standard it needs, and escalate only what fails. The gate for the most expensive model asks three questions. If a cheaper model did it badly, would I redo it? Does a wrong answer cost more than the tokens, or could I fail to notice it? Will I use the result without reworking it heavily? Two yeses out of three, or it does not go up.

Work runs in sequence or in parallel depending on what it needs. Independent tasks run side by side; a task that reads another's output waits for it. Long autonomous jobs go to their own workspace, not to the session that directs.

How are agent outputs checked?

In three layers, cheapest first.

1. Deterministic gates. Scripts that cost zero tokens and say yes or no: a scanner for third-party personal data in tracked files, a check for empty fields before a form is handed over, technical SEO checks, test suites. A run where no test ran counts as a failure, not as a pass.
2. Adversarial review by other vendors. The full artefact, never a summary, goes to models from other companies (usually GPT and Gemini, sometimes Grok and Kimi) with one job: find what is wrong. Only material without other people's data goes out. Every finding must quote the text it refers to, word for word. A gate drops the findings whose quote is not in the text. What survives gets fixed or answered in writing. The Italian pages of this site went through it before publication.
3. A person. Reviews catch many errors, not all of them. The last check is human, and so is the decision to ship.

How do I keep agents inside safe limits?

With rules written once, at the top of the repository's instructions, and repeated in the permissions so that one layer covers for the other.

• Nothing goes out without a human yes. Emails exist only as drafts. A message is sent only after I have seen the recipient and the full text.
• Other people's data is anonymised hard. Names, places, dates and every detail that could point back to a person are stripped out before any agent sees the material; whatever could still identify someone does not enter the system.
• Agents are not allowed to read credentials. They may check that a key exists, its name and date, not its value; tools use keys without showing them.
• A copy before every deletion.
• The right account, enforced. Writing to Google services is allowed only on my private account. A hook that runs before every browser action on those services asks for confirmation; an earlier mistake on the wrong account is where the rule came from.
• Autonomous agents live on another machine. They run on a separate Mac mini under a separate, non-administrator user. An agent that can edit its own settings can rewrite its own deny-list; the boundary that holds is the operating system's.

How do I keep the cost under control?

By measuring, not estimating. Once, a long session that I had estimated as modest turned out to cost many times more, measured from the transcripts at API list prices. Since then every expensive task starts with a written estimate from a script, and every long session ends with a measurement. Weekly usage has a daily budget, and the status line shows it.

Automations also have to keep earning their place. I built a routine that kept the prompt cache warm while I was away. The data showed that the warming cost more than the cold restarts it avoided, so I suspended it. Retiring what no longer pays is part of the job.

What have I built that you can see?

• AAC board maker: from a photo of a schoolbook page to a sheet with ARASAAC pictograms, for augmentative and alternative communication. Text recognition runs in the browser: the photo stays on the device, and only the words go to the ARASAAC service to fetch the pictograms. (Interface in Italian.)
• Classroom whiteboard: tools for the interactive whiteboard, including a sound meter for noise in class. (Interface in Italian.)
• casinometro-lim on GitHub: the source of both, MIT licence.
• This website: static pages, a sign-up form with double opt-in and abuse limits, its own test suite and SEO checks, built and reviewed with the method described here.

Why work this way?

For the pleasure of seeing an idea work. Before agents, turning an idea into a working solution was hard work. Now I see my ideas become working solutions in the field, not just prototypes, in less and less time. A physicist would draw it as a step: as time-to-action shrinks towards zero, the move from 0 to 1, from idea to working solution, becomes almost a jump, and its rate of change approaches a Dirac delta. What the agents save goes back to people: less fatigue and stress, more time for work and for life.

Can I teach people to work this way?

Teaching is the older half of my work. What people often lack is not the tool but abstraction: seeing their own process clearly enough to design a solution with AI. That is where I start. I teach mathematics and train teachers in Ministry-accredited courses and EU-funded projects. I facilitate online sessions with Clean Language, a method of non-directive questions that avoid putting the facilitator's assumptions into the other person's words. And the banco is written to be handed over: every project carries its own description and notes, so that someone else, or an agent tomorrow, can pick it up.

Questions people ask

Is the banco open source?

No. It holds real work in progress. The method is described on this page, and the classroom tools are public on GitHub under the MIT licence.

Do the agents act on their own?

Inside their workspace and their limits, yes: they read, write, test and review. Anything that reaches the outside world (an email, a message, a publication, a deletion) waits for a person.

Which tools and models do you use?

Claude Code as the harness, with Claude Opus, Sonnet and Fable; OpenAI Codex and GPT, Google Gemini, xAI Grok, Zhipu GLM and Moonshot Kimi as separate engines; MCP servers for external services; Python for the deterministic tools; git for every versioned file.

Why so many rules?

Because the system does real work for real people. And because many of the rules here were written after something went wrong, or nearly did.