The Intern Pattern
Plan, approve, execute, review.
Treat the agent like an over-eager intern. Plan, approve, execute, review, in that order and never out of it. Skip a move and the result is plausible wrongness shipped at machine speed.
Opinion
I've managed enough interns to know what an over-eager one does to a codebase without a plan. Three files where one was needed; an invented naming convention; the first plausible API that compiles. The agent does the same thing, faster, and with more conviction. The fix is the same one the intern gets: write the plan together, sign it, then let them type. Without the plan-and-approval gate, the agent will improvise into a wrong-shaped solution that is plausible enough to pass review.1Software 3.0 / Sequoia Ascent 2026 keynote and adjacent talks. Karpathy frames the agent failure mode as plausibility, not capability: 80% agent-driven development produces fluent, plausible-looking output that is wrong unless tightly looped to verification.
Anthropic ship Plan Mode in Claude Code precisely because the loop matters more than the model.2Claude Code Plan Mode (Shift-Tab twice). The agent reads files and proposes a plan but makes no edits until you approve. Documented in code.claude.com/docs and analysed by Armin Ronacher in “What Actually Is Claude Code's Plan Mode?” (December 2025). Cursor ships an autonomy slider. Karpathy frames the same thing as the gap between “vibe coding” and agentic engineering: the verifier in the loop is what separates a demo from a deliverable.3“Language models automate what can be verified.” The autonomy slider, the generation-verification cycle, and the distinction between vibe coding and agentic engineering all sit in the same Karpathy talk and adjacent essays. The four moves (plan, approve, execute, review) are the agent analogue of P2 Spec-First Execution. P2 says read the brief first. AI1 says write the plan, get it approved, execute, then review, every time, on every change. With a human pair-programming partner the loop is a discipline. With an agent, skipping it produces uninspectable output at machine speed.
The review leg is not optional. Anthropic's own evaluator-optimizer pattern formalises the loop: one call generates, another evaluates, the cycle repeats until the artefact passes grading.4Building Effective Agents (December 2024). Names the evaluator-optimizer pattern: one LLM call generates, another evaluates, the loop repeats until the artefact passes grading. Direct architectural source for the four-move loop. See AI6 Self-Review Pass for the agent's side of the review. The human still grades the result. Both gates close before merge.
Copy a note and link
Grab this short comment and drop it into a PR comment or an LLM chat to prompt the right change.
Plan, approve, execute, review — every change. The agent will produce plausible wrongness at machine speed unless the loop closes. Plan in writing before any edit; approve before execute; review before merge. /tenet/the-intern-pattern/AI1
AI eyes only
Rule: plan, approve, execute, review. Edits without approval are rejected.
Reject: editing files before the human has approved a plan. Reject: declaring done before a review pass. Reject: skipping the plan because the change “looks small”.
Generate: a written plan (Claude Code Plan Mode via Shift-Tab twice, Cursor plan agent, or PR description) ending with one named verification step. Wait for approval. Execute. Run the verification. Hand back with the verification result.
Diagnostic: name the verification step before any edit. If the verification is “it looks right”, stop and rewrite the plan with a runnable check.
Why?
- Catches the agent's signature failure mode — confident, fluent code that solves the wrong problem — before it lands. The plan-and-approval gate is the only place a human can intervene at the cost of minutes rather than the hours an unwind costs.
- Pairs cleanly with P2 Spec-First Execution. The four moves are the agent analogue of the human spec-first protocol; the same discipline runs at both layers without translation cost.
- Backed by the major platforms. Claude Code Plan Mode, Cursor's autonomy slider, LangGraph's plan-and-execute primitive, Anthropic's evaluator-optimizer pattern — the loop is the convergence point, not a Prickles invention.
- Slashes rework. Reading a written plan and pushing back on a wrong-shaped approach takes minutes. Reverting a half-built implementation, untangling its imports, and reissuing the prompt takes an afternoon.
- Compounds with AI6 Self-Review Pass. The agent grades its own work first; the human grades the result. Two gates with different failure modes catch different bugs.
- Encodes once in AI2 Persistent Brief and applies on every session. The four moves become house style instead of a discipline you remember to enforce.
- Compresses without breaking on low-stakes work. A one-line plan, a one-line approval, and a diff read still execute the four moves — the discipline survives even when the work doesn't earn the full ceremony.
Origins
The four-move loop is not new. It is the engineering manager's playbook for an intern, the staff engineer's playbook for a junior, the open-source maintainer's playbook for a first-time contributor: write what you're going to do; let me read it; do it; let me review it. The agent inherits the same protocol because the failure mode it faces is the same one a junior faces — confident output that solves the wrong problem — only faster and at higher volume.
Anthropic formalised the loop in Building Effective Agents (December 2024) under the name evaluator-optimizer: “one LLM call generates a response while another provides evaluation and feedback in a loop ... mirrors the iterative writing process a human writer might go through when producing a polished document.”4Building Effective Agents (December 2024). Names the evaluator-optimizer pattern: one LLM call generates, another evaluates, the loop repeats until the artefact passes grading. Direct architectural source for the four-move loop. The same paper documents orchestrator-workers with approval gates as the production pattern when the work is non-trivial. Anthropic's Effective Context Engineering paper (October 2025) extends the loop to the planning leg: agents “plan and operate independently” but should gain “ground truth from the environment at each step” — that is the verify-then-execute spine of the four moves.5Effective Context Engineering for AI Agents (October 2025). Agents should plan and operate independently but gain ground truth from the environment at each step — the verify-then-execute spine of the loop.
Claude Code shipped Plan Mode (Shift-Tab twice) as the visible UI affordance: the agent reads files and proposes a plan but makes no edits until you approve.2Claude Code Plan Mode (Shift-Tab twice). The agent reads files and proposes a plan but makes no edits until you approve. Documented in code.claude.com/docs and analysed by Armin Ronacher in “What Actually Is Claude Code's Plan Mode?” (December 2025). Cursor ships an equivalent plan agent and an autonomy slider with named levels (Tab, Cmd+K, Cmd+L, Cmd+I).6Cursor docs — autonomy slider with named levels (Tab autocomplete, Cmd+K inline edit, Cmd+L chat, Cmd+I composer / agent). Same loop, different surface. LangGraph ships plan-and-execute as a prebuilt pattern.7LangGraph documentation — plan-and-execute is shipped as a prebuilt agent pattern alongside ReAct and Reflexion. The four-move loop has industrial implementations across the major orchestration frameworks. The convergence across the major tools is not coincidence; it is the loop the task structurally requires.
Karpathy's framing of generation-verification cycles and the autonomy slider sits in the same tradition. His Sequoia Ascent 2026 talk is the cleanest single-source statement: “language models automate what can be verified.”3“Language models automate what can be verified.” The autonomy slider, the generation-verification cycle, and the distinction between vibe coding and agentic engineering all sit in the same Karpathy talk and adjacent essays. The loop is the verification. Without it, the agent is a generator without a grader, and the work is shipped on the strength of the agent's self-confidence — which, on every published benchmark, exceeds the agent's actual reliability.
Quotes
One LLM call generates a response while another provides evaluation and feedback in a loop — this workflow mirrors the iterative writing process a human writer might go through when producing a polished document.
Language models automate what can be verified.
Plan mode makes Claude Code draft a full written plan before it changes any file, and waits for your approval.
Treat AI-generated code as a helpful draft that must be verified. Never commit code you can't explain.
Evidence
Twenty external sources, ranked by author authority. The first five are the canon; expand to see the rest, including the qualifiers and the named opposers. Each links out to its primary source.
- 01Building Effective AgentsSupportsNames the evaluator-optimizer pattern as a production workflow: one LLM call generates, another evaluates, the loop repeats. Source-of-record for the review leg of the four moves.
- 02Agents should plan and operate independently while gaining ground truth from the environment at each step. The verify-then-execute spine of the loop.
- 03Shift-Tab twice enters Plan Mode. The agent reads files, proposes a plan, and makes no edits until the human approves. Direct UI affordance for the first two moves.
- 04Practitioner walk-through of Plan Mode. Documents the friction the gate is designed to introduce — and why teams that drop it produce confidently wrong output.
- 05“Language models automate what can be verified.” Frames the autonomy slider and the generation-verification cycle as the load-bearing distinction between vibe coding and agentic engineering.
Sixteen sources across the four moves. Anthropic's own engineering posts (Plan Mode, Building Effective Agents, Effective Context Engineering) supply the canon for plan and review. Armin Ronacher's Plan Mode field-notes and Karpathy's autonomy-slider framing extend the row. The workflow-primitive literature sits further down. The opposing view (that aggressive autonomy beats slow loops) is real and addressed in the reply.
Enforcement
Apply these rules in dangerfile.ts. The full enforcement across every tenet lives on the implementation page.
| Rule | Tool | Catches |
|---|---|---|
| danger-js — PR body sections | Danger JS | PRs missing the Plan / Approval / Self-Review sections in the body. |
| actions/checkout + dangerfile | GitHub Actions | PRs that pass review-eyes but skip the loop. Runs Danger on every PR event so the gate cannot be edited away. |
| Husky commit-msg hook | Husky | commits whose message is missing Plan / Approved-By / Reviewed-By trailers. The trailers are the auditable record of the four moves. |
| Commitizen schema | Commitizen | commits that skip the structured trailers. The schema makes the four-move record machine-readable and machine-checkable. |
dangerfile.tsconfiguration snippet
import { danger, fail, warn } from 'danger';
const body = (danger.github.pr.body ?? '').toLowerCase();
const hasPlan = /## plan\b/.test(body);
const hasApproval = /## approval\b/.test(body) && /signed[- ]off/.test(body);
const hasReview = /## self[- ]review\b/.test(body);
if (!hasPlan) {
fail('AI1: PR body must include a "## Plan" section. Plan, approve, execute, review.');
}
if (!hasApproval) {
fail('AI1: PR body must include a "## Approval" section with a signed-off line.');
}
if (!hasReview) {
warn('AI1: PR body should include a "## Self-Review" section before human review.');
}AI rules
.cursor/rules/ai1-intern-pattern.mdc---
description: Prickles AI1 — The Intern Pattern
globs: "**/*.{ts,tsx,js,jsx,py,java,php}"
alwaysApply: true
---
## Prickles AI1 — The Intern Pattern
Treat the agent as an over-eager intern. Run the loop in four moves: plan, approve, execute, review. Skip a move and you produce plausible wrongness at machine speed.
Plan before you type. Use Plan Mode (Claude Code), spec-first prompts (Cursor), or a written outline checked into the PR description. The plan names files, decisions, and the verification step.
Approve in writing. The plan is a contract; approval is the gate. No edits until a human (or the orchestrator agent) signs off.
Execute in small, reviewable units. The agent runs the plan; the next gate is the review pass.
Review every change. The agent grades its own work first (see AI6 Self-Review Pass); humans grade the result. Both gates close before merge.Repo layout, CI, and ESLint wiring for these paths live on /implementation — not repeated on every tenet.
Counter-argument
The honest steelman is that approval gates kill velocity. If the agent can write, run, and self-grade a feature in three minutes, a human-in-the-loop approval step adds twenty minutes of latency and converts the agent from a peer into a typewriter. Cognition's Devin and its imitators bet the other way: full autonomy with retroactive review. Karpathy himself acknowledges the slider has a top end and that the right setting depends on the task.3“Language models automate what can be verified.” The autonomy slider, the generation-verification cycle, and the distinction between vibe coding and agentic engineering all sit in the same Karpathy talk and adjacent essays. For high-volume, low-stakes work (lint fixes, dependency bumps, scaffold files, throwaway scripts) the four-move loop is overhead the work does not earn.
Counter-argument retort
The velocity argument concedes the rule for everything that matters and asks for an exception on the work that doesn't. The exception is fine; the rule still holds.
For high-stakes change — production code, schema migrations, public-API surface, anything a customer or a colleague depends on — the loop is not overhead. It is the cheapest way to catch the failure mode the agent cannot catch on its own. Plausibility is the failure mode, not capability. The agent will type fluent code that compiles and passes its own tests and is wrong; the only place a human can stop that before it ships is the approval gate. Cognition's Devin demos read like demos for the same reason vibe-coded weekend hacks do: the loop closes only at the end, after the bad assumptions are baked into the tree.
For the low-stakes carve-out — throwaway scripts, scaffolds, mechanical refactors, lint fixes — the loop compresses, it does not vanish. The plan is one line in the prompt (“run the codemod against everything under src/components”); the approval is the same prompt; the review is reading the diff before commit. Three of the four moves still happen. The discipline survives in compressed form because the failure mode survives in compressed form: a confidently typed mechanical refactor that touches the wrong files is harder to undo than the change it was supposed to make.
The deeper point is the one P2 Spec-First Execution makes for humans: the loop is not a tax on velocity, it is the velocity. A plan you can read in two minutes saves an hour of unwinding the wrong implementation. The same is true with an agent in the seat — more so, because the agent can do that hour of damage in the time you spent reading the prompt.
Notes
- [1]Andrej Karpathy — Software 3.0 / Sequoia Ascent 2026 keynote and adjacent talks. Karpathy frames the agent failure mode as plausibility, not capability: 80% agent-driven development produces fluent, plausible-looking output that is wrong unless tightly looped to verification.
- [2]Anthropic / Armin Ronacher — Claude Code Plan Mode (Shift-Tab twice). The agent reads files and proposes a plan but makes no edits until you approve. Documented in code.claude.com/docs and analysed by Armin Ronacher in “What Actually Is Claude Code's Plan Mode?” (December 2025).
- [3]Andrej Karpathy — “Language models automate what can be verified.” The autonomy slider, the generation-verification cycle, and the distinction between vibe coding and agentic engineering all sit in the same Karpathy talk and adjacent essays.