I should start with the disclosure, because the rest of this only makes sense after it.
I run a Stephen King site in Spanish. One person, 346 commits since 25 March 2026, 672 URLs live on Vercel's free tier — Next.js and Sanity. The archive is 90 books, 139 short stories, 128 screen adaptations, 129 characters and 18 places, all cross-linked. On top of it sit 167 published pieces.
Most of that text was written by an AI agent. It wakes up every four hours, decides what the site is missing, researches it, writes it in Spanish and publishes to production without anyone reading it first. The Instagram and Threads posts are generated from the same archive. The newsletter assembles itself every Friday.
A human still does four things: decides which books may be reviewed at all, presses Send on the newsletter, answers the comments, and owns every correction. Illustrations generated by AI say so on the card.
That's the setup. What follows is the interesting part, which is not "how I made an AI write articles" — that's a weekend — but what six months of it running unattended, in front of real readers, actually taught me.
It doesn't hallucinate randomly. It hallucinates appropriately.
This is the finding I'd keep if I had to throw out everything else.
On 11 June the site was publishing "The past is never dead. It's not even past" as a line from King's Gerald's Game. It's Faulkner, from Requiem for a Nun.
On 28 July a reader wrote in about a sentence attributed to The Green Mile that does not exist in the book. I audited the whole quote file and it was not an isolated case: 90 quotes came down to 70, with 34 removed as invented, paraphrased or misattributed. One belonged to Christian Nestell Bovee. One was Lord Chesterfield's. In the CMS, of 16 featured book quotes, 15 did not exist — and the one on Cujo had inverted the meaning of the real sentence, so a dog who "had always tried to be a good dog" came out saying the opposite.
Sit with the shape of that for a second. Not one of those was a weird artefact. Every single fake quote fit its slot better than a real one would have: more thematic, better cadence, more quotable. The model wasn't failing at its job. It was doing its job — produce the most plausible continuation — in a context where plausible and true are different things.
Which is why the obvious defence doesn't work. "I'll just read it before it goes out" assumes errors look wrong. These don't. They are optimised, by construction, to survive exactly the kind of review a human gives prose. The Cujo line read better than King's actual sentence. I would have approved it.
The same audit turned up the other two shapes this takes:
Invented precision. The anniversaries section had most days simply made up. Misery was filed under January; it was published on 8 June 1987. Asked for a date, a model will give you a date.
Confident folk knowledge. The site claimed King has a clown phobia. He has said the opposite — he picked a clown because children are already afraid of clowns. It also had him personally suing the government over a Twitter block; that suit was the Knight First Amendment Institute's, with seven other plaintiffs.
None of this came from a badly written prompt. Three of the four were, in a sense, the model being good at writing.
A prompt is a wish
So I wrote a truthfulness protocol. It's about forty lines, it sits above everything else in the agent's instructions, and I'm not going to paste it here — but four of its decisions are the ones doing the work, and they generalise to any pipeline:
It outranks the instruction to produce. Explicitly, in writing: this protocol takes priority over every other instruction, including the instruction to produce content. An agent asked to write an article will write an article. If nothing in its instructions outranks that, it will reach for the material it needs, and if the material isn't there it will manufacture it. That sentence is the single most load-bearing line in the whole system.
A quote is only a quote if you can name the source inside the sentence. Not "verify it" — a model will happily report that it verified something. The rule is mechanical: if you cannot write "he told Rolling Stone in 2014" in the text itself, there is no quote, delete the line. It converts an unfalsifiable internal state into a visible artefact on the page.
Never invent the day. If you only know the month, write the month. Models don't like leaving a slot empty, and an empty slot is not a defect.
Interpretation gets marked as interpretation. "It can be read as", never "it is".
There's a fifth that isn't about truth but about tone, and it took me longer than it should have: verification is performed, not published. A piece once went out with a footer explaining that its dates had been checked against the site's archive. Naming the source of a fact is information a reader uses. Narrating your own diligence is not — it reads as a defence, and it presumes someone was suspicious.
And one hard gate that isn't a prompt at all: the agent cannot review a book unless a person has marked it read. Not a guideline — the query that picks the next review filters on that flag, so an unread book is invisible to it. A signed opinion about a book nobody read isn't a review, it's an invention with someone's name on it, and that's precisely the thing a site like this is promising not to do. If the flag is empty, the run produces no review. That happens a lot. More on that below.
Now the part that matters: all of the above is a prompt, and a prompt checks nothing.
On 25 August I found, by accident, an article that referred to The Stand by a Spanish title that has never existed in any language, on the page of a central character. It had been live for almost three months. Nobody had caught it because nothing existed that could catch it — the protocol asks the model to verify; it has no way to notice when the model didn't.
Make the claims checkable by something that isn't prose
That was the turn. You cannot verify prose with prose, and you cannot verify a model with the same model in a more serious tone. What you can do is arrange for its claims to collide with structured data that a script can read.
Contradiction, not correctness. The auditor I wrote doesn't know anything about Stephen King. It knows that when a text writes "Some Title (The Stand, 1978)", the English original in brackets identifies the book unambiguously — so if the Spanish title in front of it isn't one the catalogue has for that book, it's invented, and the run exits non-zero. Same for years that match neither the book nor any of its adaptations, and for long quotations with no attribution anywhere near them. It catches nothing subtle. It catches exactly the failure that survived three months.
Duplicate on meaning, not on identity. Two nearly identical essays on the same director went out six days apart. Different slugs, so the script's idempotency check waved both through: same subject, same argument, even the same examples, 319 words against 688. Idempotency protects you from running a script twice. It does nothing about writing the same article twice. The rule that replaced it compares entity plus angle against everything already published, including drafts, and either discards the new piece or extends the old one.
Put the claims in version control. On 8 September a follower asked which part of Desperation Randall Flagg appears in. He doesn't. The claim came from an unreviewed initial import, and the site had already published it twice on Instagram. So every relation between a book and a character or place now lives in a versioned ledger with a verdict, a source and a URL — not only in the CMS — because in a versioned file, adding a claim is a change somebody sees in a diff. It started at 49 backed claims out of 369 and ended at 362 of 362. Seven came out, one went in. A small game built on those relations lost three playable threads. That was the correct price.
And the one that actually cost me the most: three days after removing Flagg and closing the case, the book's page still said — in visible text and in the JSON-LD Google reads — that the novel shares recurring characters including Randall Flagg. The FAQ answer had been derived from the relations once and stored as text. Correcting the source data didn't touch it. Worse, the sentence had been generated using any character on file, without checking the character recurs anywhere: it was on 49 of 90 book pages, and on 32 of those, none of the characters named actually recurred.
So, the two rules I'd carve above the door:
The protocol stops an error being written. A script stops it surviving. Different jobs. You need both, and only the second one is evidence.
A corrected fact does not fix a published copy. Anything derived and stored is a cache. If you don't re-derive it on every change, you've built a cache with no invalidation and called it content.
What restraint actually costs
Here's the number I find hardest to argue with, and it's not a traffic number.
Since the run log started on 31 August: 124 runs. 53 published something. 71 published nothing at all. The last 50 runs in a row produced no content whatsoever.
Nothing is broken. The inputs ran out. No unread-but-marked book means no review to write. Every recent King news item is already covered. The only search query left in the queue is one the queue itself flags as too competitive to attempt yet — the agent has now considered and rejected it more than forty times, and written down why each time.
That is the system working exactly as specified, and it is also its ceiling, stated honestly: the machine cannot manufacture demand. It publishes when a human has given it something true to say. The rest of the time it logs the reason it didn't, which matters more than it sounds — from the outside, "closed without publishing" and "never ran" look identical, and one of those is healthy.
The mirror image of that is a failure worth stealing. The image provider started charging on 20 September, returned a 402, and because that call wasn't wrapped it took the entire publishing script down with it. The bot published nothing — not even the text-only pieces it could have shipped. A content pipeline should degrade to "no picture", never to "no content". Restraint has to be a decision, not an exception.
For completeness, since somebody always asks: over the 28 days to 20 September the site did 337 clicks and 24,103 impressions from search, against 167 and 11,543 in the 28 days before. Search sends roughly twelve times what social does. The traffic isn't the point of this post — it's just evidence that a pipeline this cautious still ships.
What I'd keep
Give the agent explicit permission to produce nothing, and make it log why. Everything else is downstream. An agent that must produce will invent, and it will invent the most plausible thing available.
Verify with code, not with prompts. The prompt is the intention. The script is the evidence. If a rule matters, something deterministic has to be able to fail on it — and arrange your data so a false claim contradicts something, rather than merely being unsupported.
Keep one hard human gate on anything signed. Not a review step you'll skip when you're busy: a gate the machine can't see past.
Assume readers will find it before you do. The two worst errors here came in from a reader and from a follower, not from me. That isn't a failure of the protocol — it's the reason the protocol exists, and the reason the claims live in git where a change has to pass in front of somebody.
The site is https://lectoresflotantes.com. It's in Spanish, so if that's not your language the thing to look at isn't the prose — it's that every quote on it carries its English original underneath. That field is mandatory. It exists so that any line on the site can be checked by someone who doesn't trust me, which after six months of this strikes me as the only durable form of credibility available to anyone publishing at machine speed.
