🐑 Part 1: Who's the Shepherd When the Sheep Write the Code?

Level 3 autonomy: the car drives itself, until it doesn't, and then suddenly it's very much your problem again.
— every self-driving disengagement report, basically

That's the deal with semi-autonomous vehicles. The system handles the boring 95% — lane-keeping, following distance, the parts that don't require judgment — right up until the moment it hits something it can't parse. Then control snaps back to you, instantly, no ramp-up, and you're expected to make a split-second decision about a situation the car has been quietly mishandling for the last four seconds.

I think about that every time Mauve pushes to a branch I didn't review.

Mauve is our internal autonomous software-development platform. Feed it a well-specified Jira ticket, it plans the change, writes the code — mostly through Claude Opus — opens the PR, responds to review comments, and merges once the gates go green. It's got autonomy levels, same as a car: review-only, spec-driven, finish-line, autopilot. The pitch is that you pick how much control to hand over.

What nobody's picked yet is who's driving when you hand over the wheel.

🐑 The Shepherd Problem

Mauve calls the human on a ticket the shepherd. Cute. Pastoral. Implies you're standing in a field with a crook, occasionally redirecting, definitely not doing the actual grazing.

In engineering terms: the shepherd accepts a ticket and reviews the output. They don't write the code. Which raises a question nobody's answered yet — if you didn't write it, are you still the author? The PR says you are. Git says you are. Mauve, in fact, will commit as you, co-authored with Opus, no asterisk. Ask it why and the answer is: by design, chat requests are treated as commits from the user. Comments left directly on the PR, somehow, are not held to the same rule. Nobody can tell you why that distinction exists. It just does.

What it looks like

• 🐑 Mauve replying to reviewer and bot comments without the shepherd signing off on any of it
• 🐑 Mauve commenting on my own PR as me — my name, my avatar, words I didn't write
• 🐑 A PR "approved" with a review body that's just a celebratory GIF, logged like it was actionable feedback
• 🐑 A shepherd who can apparently be swapped out mid-flight, with zero clarity on what happens when the shepherd, the PR author field, and the Jira assignee all disagree about who's holding the crook

The upside

When it works, it's genuinely useful. It clears the boring 95% — the boilerplate, the scaffolding, the parts of a ticket that were never the interesting part of the job. That part isn't in dispute. Nobody's mourning the loss of writing the fortieth CRUD endpoint by hand.

The tension

The upside only holds if "shepherd" means something. Right now it doesn't. It's a job title with no defined authority attached to it — you're responsible for output you may not have meaningfully approved, credited under a name that isn't functioning as a signature anymore. That's not oversight. That's just liability with a nicer noun.

🚗 Who's Driving?

Autonomous vehicles solved this problem, sort of, by admitting the truth: once the human isn't meaningfully in control, accountability shifts off the human. That's an uncomfortable answer, but it's an answer. Nobody's pretending the driver of a Level 4 car is really driving.

We haven't had that conversation about Mauve's autopilot mode yet. We're still pretending the shepherd is driving.

I watched autopilot try to push a branch and open a PR, fail, retry through the UI three separate times, and only succeed after I coaxed it — in chat — into trying a different approach. That's not autonomy. That's a car that needs you to grab the wheel every four seconds while the badge on the dash still says "self-driving." And when it drifted off spec across two related repositories, splitting work it couldn't finish and asking me what to do — I had to assume it would just say so if it hit something it genuinely couldn't do. It didn't. It kept going and let me find out later.

If the system is driving the final state of the code, and the human is only there to intervene when it breaks, the human isn't the driver anymore. They're the guy in the passenger seat everyone still blames for the crash.

🔁 The Coordination Tax

Here's the part that should worry leadership more than it worries the skeptics: Mauve doesn't fix the bottleneck. It accelerates the thing feeding the bottleneck.

Before Mauve, my problem was PRs sitting unreviewed because there weren't enough eyes to go around. That problem still exists. I currently have ten PRs sitting in the queue waiting for review, and I could generate ten more before lunch. Mauve didn't touch the constraint — human review bandwidth — it just cranked up supply against a fixed demand. That's not automation solving a bottleneck. That's automation feeding a bottleneck faster than it can be starved.

And when Mauve gets confused, the coordination cost isn't hypothetical:

• Two separate PRs opened for the same ticket, discovered only after I'd already reviewed one — now I own reconciling two divergent implementations by hand
• Permission to modify a PR it opened, revoked mid-review, for no reason anyone could explain
• A change that spans two repositories, specced in both, implemented in one, with Mauve asking me to resolve the gap it created

None of this is a shepherd being bad at shepherding. This is the tooling manufacturing new coordination work while marketing itself as the thing that removes coordination work.

🧯 The Boundaries Nobody Fixed

Our senior director's take, more or less, was: if you think Mauve doesn't work, it's because you're not a power user. You're uncomfortable with change.

I've been shipping with AI-assisted tooling since Copilot's public beta. Discomfort with change is not my failure mode here. So let's talk about what actually broke, because none of it was a skill issue:

• Our internal search tool handed me the wrong link to Mauve entirely
• I missed an intro workshop that wasn't on my calendar and was expected to just know the tribal knowledge anyway — for a concept the team insists isn't complex
• Mauve has no access to its own documentation, so when I had a real question about how it works, I had to go find a human, defeating the entire premise of removing humans from the loop
• Re-authentication dialogs popping mid-task, repeatedly, no explanation
• A summary bot that reposts full images every time it "addresses comments," turning PR threads into an unreadable image dump
• Draft-status comments spammed into Jira tickets that stopped being drafts days earlier

Blame the boundaries, not the shepherd. Every one of these is an infrastructure failure — a broken handoff between systems that nobody owned closing the gap on. Calling that a "power user" problem is a category error. You don't fix a broken link by being more comfortable with change.

I Was Debugging a Bug That Didn't Exist

I want to be specific about the cost of getting this wrong, because vague gestures at "friction" undersell it.

I was verifying an implementation Mauve had generated. Pulled up the code, started the app, saw data that looked off, and spent close to an hour convinced the implementation was broken — digging through the diff, re-reading the spec, getting increasingly annoyed at a system that couldn't explain itself. Mauve, obviously, had no way to tell me otherwise. It just watched me try to fix a problem that wasn't there. It kept guessing and gaslighting itself.

I was looking at production data. I had never actually gotten my local environment running against this change. The "bug" was my own setup, not the code.

I ended up going to Claude — a different tool, a chat window, the old-fashioned way — to actually get local running so I could tell real problems from imaginary ones. The autonomous platform that was supposed to remove me from the implementation loop could not help me answer the single most basic engineering question in the whole exercise: am I even looking at the right thing?

That's the tell. Autonomy doesn't remove the need for engineering literacy. It just raises the price of not having it, because now you're debugging the agent's blind spots on top of your own.

Final Thought 💭

Is Mauve saving us time? Sure — on the ticket-shaped, well-specified, boring 95% that I don't have to even look at. Nobody's arguing that.

The real question is the one nobody at the top wants to sit with: when the system is driving the final state of the code, who's accountable when it drives us into a ditch? Not "who gets blamed." Who's actually, structurally, on the hook.

Until that question has a real answer, "shepherd" is just a nicer word for the guy holding the bag.

The sheep don't need a shepherd. They need someone to tell them who's driving.