Traditional software launches when the feature goes live.
AI systems start producing their most useful evidence when the feature goes live.
That does not mean the AI should rewrite itself in production. It means real work creates signals that a demo cannot produce: corrections, failures, approvals, exceptions, complaints, handoffs, retries, and quiet successes.
The leadership question after launch is not only:
Is the AI working?
It is:
Are we learning safely from the work the AI is doing?
That is the feedback loop.
The operating model
Post-launch AI needs a managed loop, not a suggestion box.
instrument -> capture -> classify -> propose -> review -> test -> release -> monitorEach step has a job:
| Step | Business question |
|---|---|
| Instrument | Can we see what happened? |
| Capture | Did the run leave evidence, decisions, and human corrections? |
| Classify | Is this a one-off issue or a recurring pattern? |
| Propose | What change would prevent the same issue next time? |
| Review | Who has authority to accept that change? |
| Test | Does the change improve the scorecard without creating new risk? |
| Release | How does the change move through rollout stages? |
| Monitor | Did production behavior improve after release? |
In ContextOS, this is the Improvement Loop. The loop is not “let the model learn live.” It is “turn operational evidence into reviewed, tested, versioned improvements.”
This is not only a ContextOS preference
Current AI governance guidance points in the same direction.
- NIST AI RMF 1.0 treats AI risk management as a lifecycle practice. It calls out that risks measured in a lab can differ from risks that appear in real-world operation, and its governance and measurement functions include feedback, incident identification, end-user reporting, and deployment-context review.
- ISO/IEC 42001 frames AI management as policies, objectives, processes, monitoring, and continual improvement for organizations that develop, provide, or use AI systems.
- OECD AI Principles say AI systems should remain robust, secure, and safe throughout the lifecycle, with mechanisms to override, repair, or decommission systems when needed.
- EU AI Act Article 72 contains post-market monitoring provisions for providers of high-risk systems. Determine the actual role, system classification and applicable dates against the official implementation timeline; this operating model does not establish legal applicability or compliance.
- Microsoft’s responsible agent guidance recommends human-in-the-loop feedback, monitoring, auditing, and continuous improvement for deployed agents.
The plain-English version: serious AI work needs an operating cadence after launch.
What every run should leave behind
After launch, every meaningful run should produce an inspectable record:
| Field | Example |
|---|---|
| Trace | The AI looked up the order, checked policy, asked for identity evidence, then drafted a refund decision |
| Receipt | The final decision, supporting evidence, policy rule, tool calls, and approver |
| Score | Whether the run met policy, utility, latency, safety, and cost expectations |
| Correction | What a human changed and why |
| Escalation | Where AI needed help and whether the handoff was useful |
| Approval | Where human authority was used |
| Failure | What broke, repeated, or surprised the team |
Keep eligible bounded metadata and source references rather than copying every sensitive transcript or argument into a feedback store. Collection and candidate storage already require current owner/tenant scope, purpose, readers, actual model/reviewer processors and retention. Inventory summaries, embeddings, caches, exports and delegated copies; correction/deletion remains incomplete while required receipts are pending or externally unknown. A receipt cannot authenticate its own authority.
Without an inspectable record, the team is operating from anecdotes. With it, business reviewers can see patterns.
Do not lose corrections
The most valuable sentence in an AI operation is often:
“That was wrong; next time handle it this way.”
Do not leave that in chat, Slack, email, or someone’s memory.
Capture it as structured feedback:
correction:
workflow: support.refund.evaluate
what_ai_did: denied refund
what_human_changed: approved with retention exception
why: customer was in VIP tier and shipment breached SLA
evidence:
- refund_policy.section_4_2
- customer_tier: vip
- delivery_delay_days: 6
future_behavior: escalate VIP refund exceptions to retention managerThis local YAML describes a proposed correction, not a new policy grant. Verify the operator and evidence; an exception on one case does not authorize every future VIP refund or waive current approval. That correction can now be reviewed. It can become a test case, a policy clarification, a Context Pack change, a workflow change, or a proposed StrategyRule.
Not every fix is a prompt fix
When AI fails, teams often say, “change the prompt.” Sometimes that is right. Often it is lazy diagnosis.
| Problem | Better improvement |
|---|---|
| Missing fact | Add evidence source to Context Pack |
| Wrong tool choice | Clarify tool description or planner rule |
| Bad policy behavior | Update governance rule |
| Confusing user output | Update response examples |
| Repeated escalation | Improve workflow or authority boundary |
| Slow run | Adjust retrieval or tool path |
| Expensive run | Tune budget or context size |
| Recurring operator correction | Create StrategyRule proposal |
| User distrust | Improve receipts, explanations, or approval copy |
| New risk pattern | Add a launch gate or rollback trigger |
The model is only one part of the system.
A real feedback loop example
Imagine a customer support agent that evaluates refunds.
An illustrative week-one scenario, not measured production results:
| Signal | What the team sees |
|---|---|
| 1,200 runs | Enough volume to see patterns |
| 18% correction rate | Too high for low-risk refunds |
| 0 policy violations | Good safety baseline |
| 31 repeated corrections | VIP exceptions were mishandled |
| 12 approval delays | Finance approval path was unclear |
| 4 user complaints | Explanations sounded final when cases were actually escalatable |
A weak team says:
The AI needs a better prompt.
A strong team says:
We need three changes: add VIP tier evidence to the Context Pack, turn the human correction into a StrategyRule proposal, and update the customer-facing explanation so exceptions are not described as final denials.
Then the team tests those changes against separated search and held-out release cases before an entitled owner approves an exact new release. The proposer cannot repeatedly use held-out details to select its winner; a required failure or insufficient evidence blocks dependent promotion.
Weekly AI operations review cadence
Run a short weekly review while the system is new. Keep it operational:
- Which workflows ran?
- Which scorecard dimensions improved or degraded?
- What did humans correct?
- Which corrections repeated?
- Which approvals delayed work?
- Which failures were one-off incidents?
- Which failures indicate a missing rule, missing evidence, or bad workflow?
- Which proposals should move to testing?
- Should rollout advance, pause, or roll back?
This meeting should produce decisions, not only observations.
Good outputs are concrete:
| Output | Example |
|---|---|
| Accepted proposal | Add VIP exception rule to refund Context Pack |
| Rejected proposal | Do not auto-approve high-value refunds; keep approval gate |
| New test case | Delayed delivery plus VIP tier plus missing identity evidence |
| Rollout decision | Stay in monitored stage for one more week |
| Owner | Support operations owns policy wording; engineering owns tool receipt |
Rollout is a learning plan
Do not go from zero to everyone.
Use stages:
| Stage | What it means | Advance when |
|---|---|---|
| Shadow | AI runs silently; humans still decide | Trace and scorecard are reliable |
| Internal | Trained users try it | Corrections are captured cleanly |
| Low risk | Safe cases go live | Repeated failures are understood |
| Monitored | Broader use with heavy review | Approval and escalation paths work |
| Full | Normal operation with rollback ready | Metrics remain stable under real volume |
These are local operating labels, not canonical control profiles. Each stage needs exact current required controls plus useful success and denial/fault evidence for the actual workflow, implementation, release and environment under Conformance. A stable average or zero observed incidents cannot cover an untested mandatory control.
Rollback is healthy
Rolling back an AI change is not failure.
It means the system has control.
A mature team can say:
This candidate improved speed but increased correction rate on high-risk cases. We are re-pinning the previous harness and opening a proposal to fix the context pack.
Re-pinning affects future work. It does not reverse a sent message or payment, renew an old grant, or settle a lost acknowledgement. Preserve original operations and shared spent/reserved capacity; reconcile unknown effects through provider-specific evidence before eligible retry. A scheduled feedback job or resumed worker rechecks current owner/ancestor authority, exact approval when required, active boundary/data controls and external preconditions under current fenced ownership.
What business teams should watch
Track:
| Metric | Why |
|---|---|
| Human correction rate | Shows disagreement |
| Repeated failure themes | Shows what to fix |
| Approval delay | Shows operational friction |
| Escalation quality | Shows whether fallback works |
| Unexpected action rate | Shows safety risk |
| Cost per successful run | Shows economics |
| User retry or abandon rate | Shows trust |
| Proposal acceptance rate | Shows learning quality |
| Rollback count | Shows whether release control is real |
| Time to fix repeated issue | Shows whether the loop closes |
These metrics turn AI from mystery into operations.
The improvement loop in plain language
ContextOS has named primitives, but the plain-English version is:
| Plain language | ContextOS primitive |
|---|---|
| Notice a recurring pattern | InsightSynthesizer |
| Save a human correction | FeedbackStore |
| Turn correction into a reusable rule | StrategyCompiler |
| Research missing knowledge | ResearchQueue |
| Suggest a tuning change | Autotune |
| Surface open loops | ChiefOfStaff |
The important part is that every improvement is reviewed and tested before release.
A simple rule for leaders
If the team cannot answer these questions, the AI is not really being operated:
- What changed in behavior last week?
- Which evidence proves it changed?
- Who approved the change?
- Which scorecard improved?
- Which risk got worse?
- How would we roll it back?
AI should improve after launch through observable, accountable changes with explicit recovery limits. Background research, reviewers and child experiments still use the original shared budget and eligible data; their output proposes a change rather than granting authority.
That is the difference between a novelty tool and an operating capability.
