I encoded my design judgment. Now it reviews every commit.

The situation

My design org at Conviva had already made the shift most design teams are still debating. Designers ship functional code, not mockups, and an AI coding agent does real work in the production codebase alongside them.

That shift solved the handoff problem and created a subtler one. When people and agents are all generating work at speed, velocity is not what erodes. Coherence is. The product's promise, its voice, the emotional register a user should feel when they land: those are the hardest things to codify and the easiest to lose, one reasonable-looking commit at a time. And a design director cannot be in every conversation and every pull request. The bottleneck stopped being how fast we could produce design and became how reliably design judgment survived contact with a fast pipeline.

The reframe

The default answers to that problem are both weak. One is a style guide, a document that states the principles and then sits unread while the work drifts. The other is a linter, a set of mechanical checks that enforce surface rules and produce work that is compliant and lifeless. Neither governs the thing that actually matters.

The reframe was to stop treating design governance as one problem. It is two, and they split cleanly by what can be automated. Taste and intent, the why behind a decision, cannot be linted. Enforce them mechanically and you get soulless work that passes every check. But the behavioral contract, the design system, the voice rules, those are genuinely codifiable and testable. So I built two governance mechanisms, not one: intent encoded as a mirror that catches drift and opens a conversation, and rules encoded as gates that block a noncompliant merge. And I made the AI coding agent the one who reads both, because the agent is now doing the work, and governance has to live where the work happens.

The work

The intent layer is a document written for the agent to reason against, not to obey. It captures the product's promise, the emotional register I want a user to feel, and the handful of principles that define the product's point of view. Critically, it is written as drift signals and pause triggers rather than rules. When the agent senses the work pulling away from intent, its instruction is not to correct but to stop and ask the designer: this feels like a different direction, is that intentional. The document says so explicitly: the goal is not compliance, it is alignment; you are not the authority on taste, you are a useful mirror. Encoding judgment as a question rather than a command is the whole move.

Underneath intent sits the codifiable layer: per-surface knowledge modules that stack on a shared base and translate intent into concrete, checkable patterns. One each for data visualization, navigation, the insights surface, the design system, and the AI assistant. Each carries the exact patterns, placement rules, and escalation points for that surface, so the agent loads the right judgment for the thing it's touching.

The layer I am proudest of is the contract. I had written a behavioral contract governing how the product's AI assistant communicates: how it expresses confidence, how it separates what is measured from what it infers, how it recovers when it is wrong. In the harness, that contract becomes machine-checkable copy rules, and each rule references the clause it enforces. A violation of the assistant's voice is not a style nitpick anymore. It is a contract violation, checkable in the pipeline. This is the thesis of my book made operational: behavior specified precisely enough to test.

Two more pieces close the loop. At merge, the agent reads the git diff and generates the design, engineering, copy, and documentation handoffs from it, so institutional memory is captured from the change itself rather than reconstructed in a meeting. And the codifiable layers run as gates in the delivery pipeline, while the intent layer stays a conversation during creation. Two speeds, chosen deliberately: what can be checked is checked at the gate, what requires judgment stays a discussion while the work is still cheap to change.

This did not come from nowhere. An earlier, narrower version of the idea was a prompt-level scope guard I built to keep a single design prompt inside the design system. This is that idea grown up: not one prompt, but the whole pipeline; not scope, but judgment.

The outcome

The harness is not a document I published and hoped people would read. The whole design team now starts from it for AI-driven design work, and I taught it to them directly in a session on how it was built and why. It runs where the work happens: the codifiable checks are wired into our pull-request review, so mechanical violations get caught and fixed before a human looks, while the architectural questions get flagged for a designer instead of quietly decided by an agent. Decisions, once made, are recorded, so the same debate does not resurface a month later.

The design director is now present on every commit and every pull request without being in the room: a stand-in during creation, a gate at merge, never the authority on taste. One director's judgment, scaled across every designer, every engineer, and every AI agent touching the product, with no headcount added.