The AI drafts, the engine decides: using AI-generated plans without losing control

People who hesitate to let AI draft their plans usually cannot cite the failure mode, but they can feel it: a language model produces the most plausible-looking plan, and plausible is not the same as sound. A missing else-branch, a dependency that quietly loops, a probability invented to fill a field. Each looks fine on a canvas. Each detonates weeks later, during execution, when the cost of discovery is highest.

The hesitation is well calibrated, and the answer to it is not "our model is very good". Model quality moves with the season. The answer is architectural, and it is the oldest one in engineering: never let the thing that generates be the thing that verifies.

Two systems, one boundary#

Topolog's AI authoring is split down the middle by that rule.

The AI drafts. Express and Structured modes take a goal and decompose it level by level into a TOL program: milestones, tasks with estimated ranges, dependencies, outcomes with priors, endings (the decomposition pipeline). This is the part language models are genuinely excellent at: fluent translation from messy human intent into candidate structure.

The engine decides. Every candidate, before it reaches you as a plan, passes through the same deterministic validator that checks hand-written plans: roughly eighty structural invariants covering reachability, branch exhaustiveness, cycle-freedom, cross-level coherence, and probabilistic completeness (the full catalogue). Findings go back to the model, which revises; the loop repeats until the error count is zero or the build honestly reports what it could not fix. The forecast, schedule, and odds are then computed by the Monte Carlo engine from the validated structure. At no point does generated text flow unchecked into a number you will rely on.

The division holds even for probabilities, where it is most tempting to cheat. When a plan needs a prior the AI cannot infer, the system asks a model to calibrate it explicitly, with the question on the record, rather than letting a default slip in silently. One validator rule exists specifically to block deterministic defaults on terminal verdicts: the engine would rather stop than guess, because a guessed prior wearing computed clothes is the most dangerous artefact in the building.

Why "the AI never touches the math" matters#

The slogan compresses a real division of labour:

The practical consequence of row two: trust stops being a feeling about a model and becomes an artefact you can inspect. The plan validated, or it did not. The error list is enumerable. Re-running the forecast gives the same answer. Your scepticism has somewhere concrete to land, which is what "losing control" was always about: having nowhere to stand while a system asserts things at you.

There is a corollary worth noticing: the verification boundary is what makes the choice of model unimportant. Because nothing depends on the drafter being trustworthy, the drafter can be anyone, including a model you bring yourself. Architectures that need their AI to be right are architectures you are locked into. Architectures that check do not care who wrote the draft, and that indifference is your leverage.

Control, en route and after#

Control is not only the right of refusal at the end. The authoring flow keeps you in the loop where your information actually beats the model's: clarifying questions land before structure is committed, each decomposition level is reviewable as it appears (seven chunks at a time), and every generated artefact is ordinary TOL text afterwards: editable in the source tab, diffable, revertible. Accepting an AI draft is not adopting a black box. It is merging a pull request you can read, from a contributor whose work was CI-checked before you ever saw it.

That is the whole trick, honestly stated. Not a smarter model: a boundary. Generation on one side, verification on the other, and the only thing that reaches your calendar is what survived the crossing.