What is the tenth man doctrine?

A structural dissent rule: when everyone agrees, one participant is obligated to build the strongest case for the opposite conclusion. The point is not that consensus is usually wrong. It is that consensus switches off scrutiny at the exact moment the decision gets expensive, so dissent must be assigned rather than hoped for.

How do you red team with AI agents?

Spawn refuter panels whose default stance is that every finding is wrong. In my system a finding survives only if at most one of three refuters can kill it with cited evidence. The default-refuted stance is the whole trick: a reviewer told to verify will nod, a reviewer told to refute must go find the receipts.

When should a red team be invoked?

On mechanical triggers, never on a feeling. Mine fires on consensus, on every proposal to make a report-only check blocking, on every charter change, on the top-ranked decision in each weekly briefing, on the week's proposed lessons as a batch, and whenever the founder asks. A trigger that fires when things feel too comfortable never fires.

Does adversarial review actually change decisions?

Measurably. My operating constitution went through 7 adversarial rounds with roughly 270 agents: 126 findings were accepted and patched, and 35 were killed by the refuter panels themselves. The killed findings matter as much as the accepted ones, because a red team that never rejects anything is just a second yes.

The Tenth Man Is on Payroll.

The most dangerous output my company produces is agreement.

Not bugs. Bugs get caught by 103 guards and a wall of tests. Agreement sails through everything, because every system I built checks whether work is correct, and nothing about correctness protects you from a room full of yes.

So I put the tenth man on payroll. When 9 of my agents agree, a 10th is summoned whose entire job is to argue the other side, with receipts.

Consensus is not a green light here. Consensus is a trigger.

Where does the doctrine come from?

The tenth man rule is usually told as intelligence-community lore, a cousin of the devil's advocate the Vatican kept on staff for four centuries to argue against every candidate for sainthood: if nine analysts reach the same conclusion, the tenth must build the strongest possible case for the opposite one. Not because consensus is usually wrong. Because consensus switches off scrutiny at exactly the moment the decision gets expensive.

Human organizations implement this badly, when they implement it at all. The designated dissenter softens the objection to stay likable. The room hears the dissent as a ritual and moves on. Dissent assigned to a person collides with the person's need to keep working there.

Software has no such need. My tenth man cannot be worn down, does not want a promotion, and does not care that the room sighed.

Why does this bind harder for agents than for people?

Because a room of people disagreeing is nine opinions. A room of agents disagreeing is often one opinion, sampled nine times.

My agents share weights, training, and usually a prompt. When they converge, that convergence is not nine independent minds arriving at the same place. It is one distribution asked the same question repeatedly. Independent agreement is evidence. Correlated agreement is a louder copy of the same guess, and on the way past it is indistinguishable from the real thing.

Two people shaped how I hold that.

Roman Yampolskiy asks whether the AI we build can be controlled at all, and argues the answer may be no. Take that seriously for five minutes and consensus stops being reassuring. If you cannot verify the steering, a fleet agreeing with you is not evidence that you are right. It is evidence that they are similar.

Eliezer Yudkowsky grants you the steering and asks the harder question, whether you know where you are going. A system optimizes the target that was written down, not the target that was meant, and the gap between those two is invisible from inside, because everything inside is busy succeeding at the written one.

Put them together and you get the reason the tenth man is on payroll rather than on call. Yampolskiy says do not trust the agreement. Yudkowsky says do not trust the goal. Neither is a bug a test catches, because both of them look exactly like the system working.

I am not building on their conclusions. I am building on their questions. I run a company on a legion of agents anyway, which is a bet that the answer is better than they fear. The tenth man is what that bet costs.

The default stance is refuted

The mechanism that makes this work is one sentence long, and it is the sentence most review systems get backwards.

Every finding enters review presumed wrong. Three refuters attack it, and it survives only if at most one of the three can kill it with cited evidence.

A reviewer told to verify will nod. Verifying feels like reading generously, finding the intent, extending credit. A reviewer told to refute has to go get the receipts: the file, the line, the log, the counterexample. The default-refuted stance converts review from a mood into a hunt.

The receipts from running this at scale: my operating constitution went through seven adversarial rounds, roughly 270 agents in total. 126 findings were accepted and patched. 35 were killed by the panels themselves.

Those 35 matter as much as the 126. A red team that never rejects anything is not a red team. It is a second yes with better vocabulary.

Six triggers, none of them a feeling

The failure mode of every devil's-advocate scheme is the summoning rule. "Invoke it when things feel too comfortable" is a trigger that never fires, because comfortable is precisely the state in which nobody reaches for the alarm.

So the triggers are ratified and mechanical:

Consensus of the board or the agent legion
Every proposal to make a report-only check blocking, because that changes what can stop a commit
Every charter change or new seat, because that changes who holds power
The number-one ranked decision in each Friday briefing, always, no exceptions for obvious ones
The week's proposed lessons, reviewed as one batch, because lessons rewrite how future agents behave
The founder asking, at any time, about anything

Notice what is on that list: the moments where authority moves. Notice what is not: anything requiring someone to feel uneasy first.

And when a dissent survives refutation, it does not get buried in an appendix. It rides in the Friday briefing's highlights, labeled as dissent. The org is required to look at it.

What does adversarial review cost?

Adversarial review is expensive, so the spend follows one rule: the strongest available model, on demand, never on a schedule.

Routine work runs on routine models. But a red-team pass on a charter change or a constitution runs the best reasoning available that day, because that is the exact place where being wrong compounds. Depth where reversal is expensive, never as a standing cost. A scheduled red team decays into a checkbox; a summoned one arrives with the budget the decision deserves.

A worked example: the master execution plan went under a six-lens panel of 70 agents. 30 raw findings consolidated to 21. 13 survived the refuters, 3 of them blockers I would not have found alone, including a prompt-injection path into the lesson system. 8 were killed. Every survivor was patched before ratification.

The honest limits

Two, and they shape the design.

My refuters share blood. Panels built from the same model family inherit the same training-data blind spots, which is why the in-house red team is complemented by an outside-lab reviewer that cannot write to anything. Internal dissent catches bad conclusions. Outside dissent catches bad assumptions.

The Tenth Man only checks conclusions. Nothing about refuting a decision checks whether the lenses that produced it were distinct in the first place, which is why the inspector general exists as a separate, independent adversary. Different failure, different organ.

What to do Next

Before your next irreversible decision, assign the dissent. One person or one model, explicitly tasked to write the strongest case that the decision is wrong, with two constraints: the default stance is refuted, and every claim needs a citation. Not a devil's advocate who riffs. A refuter who hunts.

Then watch your own reaction to unanimous agreement. If a decision clears every reviewer without a single objection, that is not evidence it is right. That is the trigger.

Nine yeses and a no is a decision. Ten yeses is a blind spot wearing a quorum.