Preferences May Adapt. Policy Must Be Explicit.

A product manager asks for “smarter defaults.” An engineer ships a silent change to the confidence threshold that routes work to humans. Same release notes language—“we learned from usage.” Completely different blast radius.

Preferences may adapt. Policy must stay legible. That line is doctrine in HumanOS—not a UX preference of our own.

Draw the line once

Preferences — density, tone, digest cadence, what “more like this” means for you — may adapt when evidence and policy allow.

Policy — Fourth Law thresholds (for example confidence / review gates used by routing), who must approve org-scoped change, which keys are locked — must stay legible and merged deterministically. No “the model felt 0.62 today.” Adaptable preference prefixes (tone, digest cadence) may move under set_preference; locked policy keys cannot.

Academy and Companion surfaces may eventually personalize teaching cadence (building-toward where Academy is concerned). They still do not get to rewrite org policy under the banner of personalization.

Read the effective surface

Operators start with GET /v1/humanos/policy/effective. It returns merged JSON including learning (memory scopes, allowed feedback types, learning_requires_approval) and confidence / review fields used by routing — see also HumanOS policy: threshold and config.

Admin overlays land with PUT /v1/humanos/policy/org (delegation humanos:admin), not by editing a row in an app database.

Preference keys are classified

set_preference proposals and POST /v1/humanos/tuning/actions reject policy-locked keys and keys outside adaptable prefixes — the same gate on both paths so there is no “bypass via proposals.”

Rollback is trust

If adaptation is a product feature, undo is too: POST /v1/humanos/learning/proposals/:proposal_id/rollback after apply — details in HumanOS learning, tuning, and rollback.

Scroll-stopper: Personalization that quietly moves a compliance threshold is not adaptation—it is policy laundering.

So that…

…you tune UX without smuggling routing gates; you refuse “the agent personalized itself” as an explanation for a changed approval bar; and Monday’s audit can read policy/effective instead of reconstructing vibes from chat logs.

Go deeper

• Product: HumanOS, What is HUMΛN
• Docs: HumanOS concepts, Introduction
• Community: Learning belongs in the OS, Agents should learn—but not like this, Policy threshold and config

Series: Part 4 of 6 — Learning & Adaptation · Part 5 — Signals