Asking one agent to plan an action, judge whether the action is safe, and then execute it is asking it to be its own auditor. That works until it doesn't, and when it doesn't, there is no separation of duties to catch the mistake. The Abbey–Aviva–Abi framework exists to put checks and balances inside the workflow rather than hoping a single model polices itself.
SAFETY · May 8, 2026 · 8 min read
The Case for Separate Planning, Review, and Execution Agents
Role separation lets teams encode checks and balances into an AI workflow instead of relying on a single agent to police itself.
By MLAI Safety Engineering
Three roles, three temperaments
The framework separates creative planning, safety review, and technical execution into distinct profiles, each tuned for its job:
- Aviva — the expert. Direct, creative, and exploratory, used for generating plans and alternative approaches.
- Abbey — the polymath. Analytical and supportive, used for structured explanation and safety-oriented review of what Aviva proposes.
- Abi — the moderator. Concise and action-oriented, context- and policy-aware, used to route and to execute once a plan clears review.
Why separation makes permissions tractable
When one agent does everything, its permission set is the union of every capability it might ever need — a large, hard-to-reason-about attack surface. Splitting the roles lets the control plane scope permissions per role: the planning profile can read broadly but cannot write, the review profile can block but cannot execute, and the execution profile acts only on plans that already passed a gate.
Routing between profiles is deterministic and weight-based rather than a hidden model call, so the choice of role is itself an inspectable trace event. An operator can see not just what the system did, but which profile decided to do it and why.
Checks and balances as code
The point of role separation is not ceremony — it is that intervention points become explicit. There is a defined moment where review happens before execution, a defined boundary an action cannot cross without approval, and a defined place an operator can step in. "No autonomous write action without an observable policy boundary" is much easier to keep when the boundary is a different agent with a different mandate.