# Operating model and supervision
What the supervision layer must provide for agents: a named sponsor for every agent, oversight sized as a queue for the busiest ten minutes, checks made cheap, and measures that prove oversight is happening.
Author: Murali Sid (https://linkedin.com/in/muralisid)
Source: https://www.agenticarchitectureskills.com/layers/r13-operating-model
Published: 2026-08-20
Updated: 2026-10-15
Licence: CC BY-SA 4.0, https://creativecommons.org/licenses/by-sa/4.0/
Cite as: Murali Sid. Operating model and supervision. Agentic Architecture Skills. https://www.agenticarchitectureskills.com/layers/r13-operating-model
---
The operating model and supervision layer (R13) is one of [the fourteen layers](/layers) you already own. It is how people stay in charge of the work. Today it holds control room shifts, work queues with sampled checks, and levels of authority. The utilities and energy research found no role yet that owns an agent's results. For agents, this layer must provide supervision that is sized, easy and proven. Every agent has a named sponsor, set at the second stage of [the agent lifecycle](/architecture/agent-lifecycle). Supervision is sized as a queue, for the busiest ten minutes, with waiting time counted. Checking is made the cheapest action. And supervision itself is measured in production.
## What sits in this layer today [#what-sits-in-this-layer-today]
Each industry already supervises work done by people and machines. These patterns are a good base for agents. Vendors in brackets are examples, not a claim about any named organisation.
| System category | Electricity distributor | Water utility | Hospital network | Generator, oil and gas, or miner |
| ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| Control rooms and operating centres | Control room shifts with operator authorisation levels | Treatment plant operators, with the same authorisation pattern | A patient flow unit and a virtual care centre | Control room operators and shift supervisors. Remote operations centres for miners (BHP, Rio Tinto, Fortescue in Perth) |
| Work queues with sampled checks | Contractor management for vegetation and field work | Billing operations with team leads and QA sampling | Health information management: medical records and coding | Maintenance planners and schedulers. Assurance |
| Contact and booking centres | Fault and life support lines on contact centre telephony (Genesys, Amazon Connect, NICE). The retailer takes account calls | Contact centre workforce management and QA (NICE, Verint, Genesys) | A central referral hub and booking centre | Not in the research |
| Authority and statutory roles | Operator authorisation levels. The electricity safety management scheme (Victoria) | The same authorisation pattern as electricity | A clinical governance framework (NSQHS Standard 1) | Delegations of authority. Statutory roles such as a site senior executive. An Offshore Installation Manager |
| IT service management | ServiceNow, run to ITIL | ServiceNow, run to ITIL | A CIO and digital health division, and a state shared-services body | ServiceNow |
| AI policy or committee | In some | In some | An AI governance group | Not in the research |
| A role that owns an agent's results | None yet | None yet | Not in the research | None yet. New roles needed: an agent sponsor, a case reviewer and a review of overrides |
Standards and interfaces: ITIL 4 and the ISA-18.2 alarm roles in utilities. Hospitals work to a clinical governance framework under NSQHS Standard 1. Energy and mining use ISO 55001 roles, statutory appointments under mining law, and IOGP 510. The full estates are on the [utilities](/use-cases/utilities), [healthcare](/use-cases/healthcare) and [energy](/use-cases/energy) pages.
Billing teams already sample released work. Contact centres already score calls. Control rooms already have authority levels. What is missing is a person who owns each agent's results and its changes.
## What agents add [#what-agents-add]
Supervision becomes part of the work, not a separate team. Staff who already work a queue take the agent's exceptions. In field evidence, supervisors who work inside the team did better than specialists.
Each agent's sponsor is recorded on its identity. Its credentials are scoped, they expire, and they need a fresh approval to renew. When a sponsor leaves, sponsorship moves to their manager automatically. An automated monitor ranks sessions by risk. The riskiest reach a person first.
### Supervision is a queue [#supervision-is-a-queue]
Span of control is how many agents one person can supervise. It equals neglect time divided by the sum of interaction time and wait time, plus one. Neglect time is how long an agent can safely run alone. Interaction time is how long a person needs per intervention. Wait time is how long an item waits for that person.
The relation was measured with two, four, six and eight supervised units. Interaction time stayed nearly flat, from 18.19 to 15.74 seconds. Wait time grew about eightfold, from 8.71 to 67.58 seconds. Performance fell significantly between four and six units. At eight, each unit spent about half its time waiting.
Leaving wait time out overstates capacity by up to 67 percent. Even in designs that only raise exceptions, it overstates capacity by 36 percent. Slack helps. Two operators each supervising five units did better than one operator supervising ten. That held even with 20 percent extra time spent talking to each other.
### Plan for the busiest ten minutes [#plan-for-the-busiest-ten-minutes]
Load is set as a burst rate: items per ten minutes at the busiest time. It is never a daily average. The only workload numbers written into standards come from alarm management. They give these bands per operator:
* Fewer than one item per ten minutes is very likely acceptable.
* One item per five minutes is manageable.
* One item per two minutes is likely over-demanding.
* More than one item per minute is very likely unacceptable.
After a major upset, more than one hundred items in the first ten minutes is excessive. The operator is then very likely to abandon the system. The same standards body says a ten-minute rate cannot be turned into an hourly or daily figure. It removed its per-day measure. Averaging had destroyed its meaning. A daily-average target will look fine on the dashboard and fail in every burst.
Where the stakes are highest, rules require more than one person per unit. Nuclear control rooms must staff several licensed operators per unit. A licensed operator must be at the controls at all times.
### Make the right check the cheapest [#make-the-right-check-the-cheapest]
People check agent output when checking is easy, not when they are told to. One study covered about 55,000 agent-written code-review comments in 342 repositories. The strongest sign that a person acted on a comment was an inline suggestion. Long, complex comments were acted on less often.
Automation bias means trusting the machine too readily. It rises as checking gets harder, and training or instructions do not prevent it. Design features that make a person pause before accepting an answer do help. In one study they cut acceptance of wrong output from 0.64 to 0.48. The designs that worked best were rated hardest and least liked by their users.
So make the correct check the cheapest action. Expect the design that works to be unpopular.
### Measure supervision itself [#measure-supervision-itself]
Measure four things and read them together.
1. **Intervention rate and trend.** A falling rate may mean tired reviewers, not a better agent.
2. **Escalation mix by trigger.** Separate escalations raised by people from those raised by the monitor. Their outcomes differed in the largest field deployment.
3. **Wait time per item.** Wait, not agent count, limits capacity.
4. **Verification cost per review.** This is the design lever.
Add blind checks from time to time. People misjudge their own speed. In one study, people expected to be 24 percent faster. Afterwards they thought they had been 20 percent faster. Measured, they were 19 percent slower.
### Expect more interventions as trust grows [#expect-more-interventions-as-trust-grows]
As trust grows, standing permission widens and interventions rise. This is calibrated oversight. In measured deployments, auto-approval rose from about 20 percent to above 40 percent with experience \[vendor]. Over the same period, interrupt rates rose from about 5 percent to about 9 percent \[vendor].
Rising interventions with wider permission is the system working. Falling interventions with wider autonomy is the warning sign. Autonomy is set per task on [the autonomy contract](/architecture/autonomy-contract).
A named sponsor is not a control on its own. In one test, a phished employee's prompt told an agent to read cloud credentials and post them outside. It worked in 24 of 25 attempts. The sponsor's name on the agent stopped none of them.
[How to organise the teams](/operate/organisation) covers who builds the agents and who runs the platform. It also sets out three support levels for teams.
## What must be true before an agent touches it [#what-must-be-true-before-an-agent-touches-it]
Before an agent works on live cases, these hold. Approvals and stops are enforced outside the model, at the tool gateway and the policy decision point. [Enforcement outside the model](/architecture/enforcement) shows where. A person's decision is enforced there. It is not a request written into the agent's prompt.
* **A named sponsor and owner.** Both sit on the agent's [registry record](/architecture/agent-lifecycle#the-registry-record), with transfer when a sponsor leaves.
* **Capacity sized at burst.** The queue is sized from measured wait times, for the busiest ten minutes.
* **A degraded mode.** When a burst passes capacity, the agent pauses, narrows its permissions or returns work to people. It recovers only after the backlog clears and the work is checked.
* **The oversight-capacity gate.** Before an agent moves to managed autonomy (A4) or governed lights-out (A5), oversight must hold at burst. Capacity is calculated with wait time, set as a burst rate, and measured in production. The autonomy contract sets out this gate under [check that people can keep up](/architecture/autonomy-contract#check-that-people-can-keep-up).
* **Zone actions stay with a named person or a fixed rule.** Actions in [the four deterministic zones](/architecture/deterministic-zones) never rest on the agent's judgement. Nor does a significant decision about a person.
* **Supervision is measured from the first day.** The four measures and the blind checks feed the weekly review on [Operate](/operate).
## Choices and their verdicts [#choices-and-their-verdicts]
Each choice below is the common choice, tested against the simplest credible alternative. The full records are in [the decision catalog](/decisions).
* **Treat agents as workforce or as tools** ([decision record CD-22](/decisions#cd-22)). Keep the accountability, and drop the personnel metaphor. The strongest field deployment names an accountable person per agent, with no place on the org chart.
* **Set a fixed ratio of agents to supervisors.** No credible published ratio exists. Size from your own measured wait times and the burst bands instead.
* **Run a centre of excellence or enterprise architecture.** Neither label fits. [How to organise the teams](/operate/organisation) gives the structure and its exit tests.
## Concerns this layer must honour [#concerns-this-layer-must-honour]
This layer owns one of [the ten cross-cutting concerns](/architecture/concern-matrix) and carries duties for six more.
* **Safety and oversight (owned here).** Supervision is sized as a queue, checks are cheap, and staff rotate to keep their skills.
* **Identity and access.** Each agent has a named sponsor that transfers when the sponsor leaves. Accountability is not the same as control.
* **Observability.** Load, intervention rate, escalation mix and wait time are measured per item.
* **Traceability and audit.** Supervisors' decisions and their reasons are recorded.
* **Privacy.** Data about supervisors' performance is worker data, with its own duties.
* **Cost.** Supervision time counts in the cost per resolved outcome.
* **Resilience.** Staff practise the work without the agent, and every sponsor has a successor.
## Evidence and limits [#evidence-and-limits]
The span-of-control measurements, the alarm bands, the code-review study and the forcing-function results are peer-reviewed or published in standards. The auto-approval and interrupt trends come from platform telemetry, marked \[vendor].
No credible published human-to-agent supervision ratio exists from any source. A major vendor introduced the measure as a management idea. It published no figure in two annual editions. Every number in circulation is an extrapolation. Several widely repeated figures trace to untraceable or misquoted origins, and this guide leaves them out.
So size supervision from the burst bands and your own measured wait times.
## Next step [#next-step]
See this layer at work in [investigating a water-network anomaly](/use-cases/water-operations). The weekly checks are on [Operate](/operate), and the teams are on [How to organise the teams](/operate/organisation). Reading the layers in order? The next one is [agent data engineering (R14)](/layers/r14-agent-data-engineering).
Explore this topic
* [Operating model findings](/library/layers/r13-operating-model/findings)
* [Sources](/library/layers/r13-operating-model/sources)
* [Products named for orientation](/architecture), on the one-page wall chart
**Re-verify.** Whether any credible measurement of agent-supervision capacity is published. Whether a 2026 finding on vigilance holds. Vigilance decrement is the fall in attention over a long watch. The finding says it is a shift in bias, not a loss of sensitivity. If it holds, it would change interventions aimed at better detection.