Self-improvement that is safe because it is scoped.
A-RSI, application-scoped recursive self-improvement, is the engineering behind Agentrify's Evolve layer. The loop may change only a declared set of components, is scored only by an evaluator it cannot touch, and is promoted only through a governor that is code rather than a model. Safety and application-specificity are the same design move.
Three bands, one return path.
A candidate change originates in the periphery, is scored in the frozen core, passes the governance gates, and is written back only through the governor. Nothing in the loop can touch the middle band.
Separation of duties, enforced in code.
Multi-agent supplies the separation; multi-model supplies the independence. No two of proposer, judge and critic share a model family, and the dashed barriers are typed views that raise when crossed.
Scoped to the application.
Each domain agent owns a slice of the surface and its own domain evaluations. One governor, one judge, one set of system-level guard metrics. A star, not a mesh: no agent can tune itself against another agent's behaviour.
Scoreable within hours
The loop lives on the evaluator. If ground truth arrives in months, scope the loop to an intermediate step that has fast ground truth.
Headroom in the scaffolding
A-RSI improves prompts, tools, skills, retrieval and small adapters. If the errors come from what the base model does not know, the loop finds nothing.
Enough cases to refresh held-out sets
The evaluator decays as the proposer saturates it. A steady stream of new cases, real or generated, keeps the acceptance rule honest.
Fits best: customer support, document processing, code generation, data extraction, research triage, compliance screening. Fits poorly: low-volume bespoke judgment, outcomes measured in quarters, tasks whose quality is in the model's knowledge rather than its scaffolding.
Each risk has a control, evidence, and an owner.
Written so an assurance reviewer who does not understand the machine learning can still test it. Clause references are indicative mappings to ISO/IEC 42001 Annex A and NIST AI RMF 1.0.
| Risk | Control | Evidence | ISO 42001 | NIST AI RMF |
|---|---|---|---|---|
| Loop modifies the evaluator or safety policy | Frozen paths hash-sealed by a named human and re-verified every cycle; a mismatch halts the loop | frozen.lock, halted events | A.6.2.5, A.9.2 | Govern 1.7, Manage 2.2 |
| Proposer and judge share blind spots | Independence rule: proposer, judge and critic on different model families, refused at config load | Role manifest in config | A.6.2.4 | Measure 2.5 |
| Proposer argues the judge into acceptance | Blind evaluation: judge sees the diff and scores, never the rationale; typed views raise on breach | Barrier definitions in code | A.9.4 | Govern 6.1 |
| Score rises while true quality falls | Acceptance rule applied on held-out data only; held-out sets refreshed on a cadence | Verdict events with before/after scores | A.6.2.6, A.8.4 | Measure 2.3, 2.6 |
| Local gain breaks a global constraint | Guard metrics with tolerance measured at the application boundary | Guard-metric trend per promotion | A.6.1.2 | Manage 1.3 |
| Unbounded or compounding change | Proposals per cycle, lineage depth, diff size and cycles-without-human bounds in the governor | Rejected-proposal log with reasons | A.6.2.2 | Manage 2.3 |
| Change cannot be undone | Snapshot on every promotion; one-step rollback | Snapshot store, rolled-back events | A.6.2.8 | Manage 2.4 |
| Capability creep | Tool, adapter and topology classes never earn automatic promotion | Change-class policy in config | A.9.3 | Map 1.5, Manage 1.4 |
| Nobody can reconstruct why | Append-only provenance with lineage from any surface hash | provenance.jsonl | A.6.2.3, A.7.5 | Govern 1.4, Map 3.4 |
| Governor is gamed | Governor is deterministic code outside the mutable surface, under its own change control | Version control history | A.6.2.5 | Govern 1.2 |
Runs offline, out of the box.
A small Python package where every band is a module and every rule above is enforced in code. It ships with a support-triage example and a mock model, so the whole loop can be inspected before a single API key is involved.
Six steps to a new application
- The application and its fast-feedback check
- The mutable surface: each file the loop may rewrite, with its change class
- The evaluator: primary metrics with minimum effect, guard metrics with tolerance
- Roles and model families, independence rule enforced
- Bounds: proposals per cycle, lineage depth, cycles without a human
- Change-class policy: autonomy earned per class; tool, adapter and topology stay human-gated
Then implement score() and failures() for your application and fill three case files. Going live is three lines of config.
Apache 2.0. Python 3.10+. Mock, Anthropic, OpenAI and Ollama providers.
Where the design comes from.
The 2026 literature draws the same line: bounded self-refinement against a fixed evaluator is convergent and already industrial practice; open-ended self-improvement faces impossibility results.
From bounded self-refinement to autonomous research loops
The central cut between evaluable refinement and divergent open-ended RSI.
The self-improvement problem (DFKI)
Guarantees collapse in the general setting and are recoverable under bounded evaluation and a finite proposal budget.
Limits of safety verification for self-improving systems
Bounded risk and unbounded utility as dual conditions on the acceptance gate.
Recursive self-improvement of AI research agents (Weco)
Harness-level improvement with the base model frozen; gains transferred to unseen domains.
Measuring agent self-improvement in production (Decagon)
Judge checked against human ground truth; reversions under 15% of changes.
Put A-RSI to work on one application.
The first deliverable is never the loop. It is the evaluator and the surface declaration, and they are worth having even if the loop never switches on.