Read-Only by Design

Every design system dies the same way. Not in one decision, but in a thousand small ones: a developer needs a slightly darker border, the token doesn't exist, the deadline does, so a hex value gets hardcoded and everyone moves on. Multiply that by a few years and a few teams and your "system" is a suggestion.

AI agents make this worse, and faster. An agent asked to "make the card match the mock" will cheerfully inline #2c3e5a without a moment of guilt. It isn't being sloppy. It's being obedient. It solved the ticket. The drift it introduced is invisible to it, because the constraint was never expressed anywhere the agent could see, let alone anywhere it could be enforced.

When the AI engineering workflow for GEL, Acquia's cross-framework design system, took shape, this was the first problem to solve. Not "how do we get agents to write good component code." That turned out to be the easy part. The real problem was "how do we keep the system coherent when the number of hands touching it just multiplied."

Nobody edits tokens

The core of the workflow is a token-governance protocol with one blunt rule: design tokens are read-only. To engineers and to agents. Figma variables are the single source of truth, tokens are generated from them, and nothing downstream gets to have opinions.

The symmetry matters. It would have been easy to write agent-specific guardrails, like a line in the agent instructions saying "don't modify token files." But rules that only bind the machines don't survive contact with humans. If an engineer can hand-edit a token to hit a deadline, the agent's discipline is irrelevant. Drift enters through the other door. Making the rule universal made it legible: there is one way values change, and it starts in Figma.

This is also just easier for agents to follow than any amount of prompt engineering. "Use your judgment about when a hardcoded value is acceptable" is a prayer. "This directory is read-only" is a fact. Agents are extremely good at respecting facts.

Rigid systems get routed around

Here's the part that makes it work.

A governance system that only says no is meeting force with force, and force finds a way around. The developer with a deadline has energy and a legitimate need. Block them completely and that energy doesn't dissipate. It reroutes. A fork, a shadow stylesheet, a !important. Congratulations: your system is pristine and nobody uses it.

So the protocol has an override path. A contributor, human or agent, who genuinely needs a value the system doesn't provide can adjust an individual token locally, temporarily, through a controlled mechanism. The override is loud by design: it auto-generates a report that tells the design team exactly which token was overridden, where, and why.

The redirect is the point. The developer isn't blocked. They ship. But the override doesn't vanish into the codebase the way a hardcoded hex value would. It becomes a signal traveling in the right direction: to the people who own the source of truth. Sometimes the answer is "that's a real gap, we'll add the variable in Figma and the override dissolves on the next token build." Sometimes it's "use this existing token instead, here's why." Either way, the system absorbed the exception instead of being eroded by it.

The failure mode this replaces is worth naming: before, every one-off value was a silent vote against the design system, and the votes were never counted. Now they're counted automatically. The report turned violations into the design system's best backlog.

Governance beats vigilance

The general lesson, and the reason I think this pattern matters beyond design tokens: when agents join the team, move your standards out of people's heads and into structures that can say no.

Code review used to be the enforcement layer for all of this. A senior engineer would spot the hardcoded color and leave the comment. That never scaled well with humans. With agents generating a multiple of the change volume, it doesn't scale at all. Worse, review attention is exactly the resource you need to protect. Every mechanical "use the token" comment a human writes is time not spent on the review only a human can do.

The same reasoning shaped the rest of our AI practices: a shared instructions baseline and automated, instructions-driven PR review that enforces the quality bar before a human looks. The theme is identical: don't rely on vigilance, human or artificial. Vigilance is expensive, inconsistent, and it degrades exactly when throughput rises. Structure is cheap, consistent, and it improves when throughput rises, because every violation it catches is one that never reached a person.

None of this is a new idea. It's the same principle as types, linters, and CI. Push judgment to the edges and encode the settled decisions in the system. What's new is the stakes. AI didn't change what a well-governed system looks like. It changed the price of not having one.