Chapter 15 — Queueing Theory
“I want to bring Claire to the next one of these,” Alex had said to Victor, the week after the postmortem, and had felt, saying it, a small private satisfaction at how unremarkable the sentence had become to say out loud — a year ago she’d have thought twice before putting Claire in a room with Victor’s whiteboard, worried about the translation cost. She didn’t worry about it anymore. “The exception-cache idea keeps coming up as the thing we haven’t built yet, and I think she needs to hear the actual mechanics of why ‘just add a human reviewer’ isn’t automatically the safe answer, in a form she can push back on, not one she just has to trust me on.”
So it was the three of them, this time, in Victor’s office, the whiteboard wiped clean and waiting.
“Everyone in this building has spent the last several months learning to distrust an ungoverned agent loop,” Victor said, once Claire had settled in, no preamble, already three steps into the thought the way he always was. “I want to make sure nobody in this room walks away from that lesson with the wrong generalization, which is: therefore, put a human in the loop, and the problem is solved. It isn’t. A human in the loop is not automatically safe. It’s a different system with its own failure modes, and if you don’t reason about those failure modes with the same rigor you’ve finally started applying to the agent’s, you will build something that fails just as badly, only slower, and quieter, and in a way that’s much harder to notice until it’s already a crisis.”
He drew, this time, not the three-box control loop from months earlier but something new: a single line of boxes marching left to right, a wavy line entering from the left labeled arrivals, a single server box in the middle, a wavy line of outcomes leaving on the right.
“This is a queue. The simplest possible model of one — tasks arrive, a server processes them one at a time, tasks leave. Your proposed exception cache, the thing Devon and Alex keep sketching and not building, is exactly this: cases the agent can’t resolve with sufficient confidence get routed to a human reviewer instead of guessed at. Good instinct. Correct instinct, even. But a queue has to obey certain laws whether or not the person who built it knows the laws exist, and the law that matters most here is embarrassingly simple: if tasks arrive faster, on average, than the server can process them, the queue does not reach some comfortable steady state. It grows. Without bound. Forever, or until something breaks.”
“That seems obvious once you say it,” Claire said, and Alex could hear her testing the idea rather than merely accepting it, exactly the engagement Alex had hoped bringing her here would produce.
“It’s obvious in the abstract and it is violated constantly in practice, because the arrival rate and the service rate are rarely both known quantities when someone designs the system — they’re assumed, optimistically, at design time, and then reality supplies the actual numbers later, usually at the worst possible moment. Tell me: on the Corvid account, if every reconciliation exception above the materiality threshold routes to a human reviewer, what’s the arrival rate?”
Claire, to her credit, didn’t guess. “I don’t actually know. I know the total exception volume Corvid gave us in their onboarding data. I don’t know what fraction of that crosses the materiality threshold, because we set that threshold somewhat conservatively without a lot of data to calibrate it against.”
“Which means nobody in this room currently knows whether the queue you’re about to build is stable,” Victor said, not unkindly, laying the fact down the way he laid all of them, as simple mechanism rather than accusation. “And here is the part that should actually concern you, because it’s the part that bites teams who think they’ve solved this problem by adding a human step and then stop thinking about it: even if the average arrival rate is comfortably below the average service rate — even if the math looks fine on a spreadsheet — a queue can still blow up, because real arrivals aren’t smooth. They cluster. A single bad day, a single upstream system hiccup that produces a burst of exceptions all at once, and a queue that looked stable on paper backs up faster than anyone watching a weekly average would ever notice, until a human reviewer who used to clear their queue by lunch is sitting on a four-day backlog and nobody flagged it as an emergency because no single day’s arrival count looked abnormal on its own.”
Alex thought of Devon’s step limit, the circuit breaker that stopped an agent loop before it ran away — and felt the shape of the analogy complete itself before Victor said it. “So the exception cache needs its own circuit breaker. Its own sensor.”
“Precisely. You need to actually measure arrival rate and service rate, not assume them. You need alerting on queue depth and wait time, not just on whether the queue exists. And — this is the part people resist most, because it feels like admitting the system isn’t as autonomous as the deck promised — you need a defined, honest answer to the question ‘what happens when the queue is growing faster than we can clear it,’ because the answer cannot be ‘it keeps growing until a human notices,’ the same way the answer to a runaway agent loop couldn’t be ‘it keeps running until someone notices.’ You need an escalation path, a way to shed load safely, or a way to add capacity on demand — the specific mechanism matters less than the fact that one has to exist and be tested before the queue is live, not discovered the first time it actually backs up.”
Claire was quiet for a moment, working through it with the specific focus Alex had watched her bring to real numbers ever since the eval-suite headcount conversation months ago. “If I go back to Corvid and tell them the honest version of this — that the human-approval step isn’t just a safety feature, it’s a system with its own capacity limits that we’re going to monitor and staff for properly — that’s actually a stronger pitch than what we would have said a year ago. ‘We have a human in the loop’ used to be the whole sentence. Now I can say ‘we have a human in the loop, and we know exactly how much load it can absorb before it needs to expand, and we’ll tell you before it becomes a problem instead of after.’”
“That’s the sentence,” Victor said, and something in his face did the thing it had done back in the earliest conversation, months ago, the sharpening that Alex had learned to read as his version of real pleasure. “That’s tiered honesty, precisely, applied one layer deeper than either of you had taken it before. You’re not promising infinite capacity. You’re promising a bounded, measured, honestly described capacity, with instrumentation that tells you before the bound is breached rather than after. That is, and I do not say this lightly, the single most sellable sentence available to a company in your position, and almost nobody in this industry says it, because almost nobody has actually done the work to make it true.”
He was quiet for a moment afterward, looking at the queue diagram rather than at either of them, and when he spoke again his voice had shifted into a register Alex had heard from him only once before, in passing, months ago, and hadn’t heard since. “I worked on a switching system once,” he said, “early in my career, long before anything in this building existed even as an idea. Telecom infrastructure — real physical switches, later software ones, routing calls instead of tickets. We had a queue very much like this one, human operators handling exceptions the automated switching couldn’t resolve on its own. We knew, in the abstract, that the queue could back up under load. We didn’t build the instrumentation to actually watch it happen in real time, because it was expensive, and the average case looked fine for years, and there was always something more urgent to fund instead.” He didn’t finish the thought, and neither Alex nor Claire pushed him to. “I’ll tell you the rest of that story another time. It’s not today’s lesson. Today’s lesson is: build the sensor before you need it, not after. I learned that one considerably more expensively than either of you are about to.”
Nobody spoke for a moment after that. Claire, Alex noticed, was already sketching something in her own notebook — not the queueing math itself, but a rough draft of a sentence, the shape of a pitch, testing how the honesty would sound out loud to a customer who’d need to hear it as confidence rather than hedging. Alex watched her do it, and felt, more clearly than at any point in the last year, that the gap between the two of them — the translator and the sold, the engineer and the seller — had finally closed into something that no longer needed translating at all.