Capstone

The last session is not a module. The room designs something real, draws it, and reads what the drawing says back. Everything in the course was preparation for being able to answer the questions below about a system somebody actually owns.

Pick the subject in advance. It should be a decision or a workflow somebody in the room is responsible for, small enough to draw in forty minutes, and something at least one person disagrees about. A system everyone already agrees on teaches nothing.

Running the Session

One person drives the drawing and does not decide anything. The useful split is that whoever owns the system answers the questions, whoever knows the notation writes it down, and everybody else argues. A room where the person at the keyboard is also the person deciding produces their design rather than the room's.

The Worksheet

Work down this as a group. The questions nobody can answer are the output of the exercise, not a failure of it.

Stage	Time	What happens
Pick and frame	5 min	State the system and who owns it. One sentence on what finished looks like, agreed out loud before anything is drawn.
Work the sheet	20 min	Down the worksheet as a group. Leave unanswerable questions unticked and note who would know.
Draw it	15 min	Put it in the notation. Elements first, then the transitions, then the exits. Exits last, because they are the ones people skip.
Read the findings	5 min	What does the drawing report that nobody wrote? Unmodelled exits, prompted obligations, empty hook points.

Design worksheet0 / 16 answered

personWhat it servesAgent loop, delegation

Who is on the other side, and what do they want?A person or an external system. If you cannot name one, the design is a solution looking for a problem.How does work arrive, and how long may it take?Chat, voice, API, schedule or event. The latency budget constrains everything after this.What does finished look like, in one sentence?If finished cannot be stated, nothing downstream can decide whether it happened.

account_treeIts shapeAgent loop, delegation and handoff

How many agents, and why not one?Prompt length, tool registry size or a trust boundary. Not the org chart.For each split, does control return or not?Delegation returns, a handoff does not. It decides who answers and how many exits the run produces.What can it reach, and who owns each one?External tools break while your code does not change. Code tools change in the same pull request.

shieldWhat holds itGuardrails, trust boundaries

For each check that matters, does reaching that point run it?If a model decides whether to run the check, it is not a control.Which obligations are instruction only, and is that acceptable?Some genuinely must be. The failure is not knowing which.Where does text you did not write enter?Tool results, retrieved documents, files, fetched pages, other agents, the history.Does the same agent read untrusted content, hold something valuable and have a way to act?All three together is the dangerous case. Removing any one makes an injection inert.

logoutHow it endsTyped exits

Which of the eleven exit types can this reach?Name them. The ones you leave out are a claim that they are impossible.For each one, would it be recorded distinctly?A guardrail stop logged as an error loses the thing you would act on.Who owns each failure exit?Retries belong to whoever runs the dependency. Refusals belong to whoever owns the prompt.

fact_checkHow you would knowEvaluation unit

What are five cases you would evaluate it on?Then say which of the four sources each came from. Most rooms produce five from imagination.What is the cheapest check that would catch the worst failure?Structure, a rule, grounding, a typed decision, then a judge. In that order.What gets dropped when the context window fills, and who decided?If the answer is the oldest turns, the constraints stated at the start go first.

edit_noteWork down it as a room. The questions nobody can answer are the output of this exercise, not a failure of it.

A Worked Answer

A finished example lives in this repository at course/reference-design.puml. It is the payout assistant the course has been using throughout, written in the agentic notation, and it is deliberately imperfect: seven exit types unmodelled, one obligation enforced by nothing, five hook points empty.

Use it as a comparison at the end rather than a template at the start. A room that sees it first tends to reproduce its shape, including its gaps. A room that draws its own first gets the more useful experience of finding different gaps and having to defend them.

What Good Looks Like

The session has gone well if the room leaves with these four things, and none of them is a finished design.

Failure Modes of the Exercise

What it looks like	What to do
The room designs the system they wish they had	Ask what it does today. Draw the current one first; the better version is a second diagram and a much easier conversation once the first exists.
Everything becomes an agent	Every agent is a model call on the critical path. Ask what would break if two of them were one, and most of the time the honest answer is nothing.
Only the happy path gets drawn	Go straight to the exits. Naming the four ways it fails usually rearranges the rest of the drawing.
One person answers every question	Ask the quietest engineer what happens when the second tool call fails. The people who operate a system know different things from the people who designed it.
The room wants to start building	A good sign, and the forty minutes is cheaper than the rebuild. Finish the exits and the findings first, then let them go.

quizCheck

Forty minutes in, the room cannot agree whether a compliance check is a control or a requirement. What is the best use of the remaining time?

After the Course

The knowledge base this course sits inside goes further on most of these topics, and the modules link into it throughout. The two worth reading next depend on which way the room leaned: Decision Models if the interest was in making the cheap decisions cheaply, and Agentic Zero Trust if the uncomfortable conversation was about blast radius.

The more useful follow-up is not reading. It is running the worksheet again, on a different system, in three months, and seeing how many of the questions have better answers.

Definition