From CopilottoColleague

For a while, the most impressive thing AI could do was answer.

It answered faster than search, more fluently than documentation, and with just enough confidence to make people feel the future arriving inside a chat box. It could summarize a meeting, draft an email, explain a code snippet, brainstorm a launch plan, or produce a suspiciously polished first pass at almost anything. That mattered. It changed user expectations, product design, and the perceived shape of software. But it did not yet change the nature of work.

The deeper transition begins when the system is no longer asked only to suggest. It is asked to return with work done.

Research this market and come back with a memo. Review this contract and mark the risky clauses. Refactor this service, run the checks, and prepare the patch for review. Investigate the failure, trace the likely cause, and show me what to approve next.

That is a different standard. A helpful answer can be wrong and still useful. Delegated work is expensive in a different way. It consumes time, touches systems, shapes decisions, and often hides its mistakes inside output that looks plausible enough to pass a casual glance. That last property is the real trap: the primary failure surface is not the work that looks broken but the work that looks finished. Rafael Levi at Bright Data names the mechanism in its purest form, describing web-browsing agents that hit a block and do not say so: "There's no error, no warning, just the wrong answer." The agent, he says, "gets blocked, it needs to please you and it makes things up" — the same shape of failure recurs anywhere an agent is allowed to report on its own success: a test claimed to pass, a source claimed to be checked, a step claimed to be done. The moment AI crosses from consultation into execution, eloquence stops being the main thing that matters, and the casual glance stops being an acceptable form of review. What matters is whether the system can produce bounded, inspectable, dependable work — verified by something other than the system's own account of itself.

Joel Hron gives the cleanest formulation of this shift: the north star has moved “from helpfulness to productive.” In the same vein he describes the target as systems that don’t just suggest but plan their own work, execute it, and replan as they learn. That single move rearranges the field. Once we ask AI to actually produce output, make judgments, and act on behalf of users, the central problem is no longer prompt cleverness. It is trust under action.

AI engineering begins where prompt engineering stops being enough. It is the discipline of turning raw model capability into delegated work that can be structured, measured, supervised, and trusted.

The real transition is from suggestion to delegation

The confusion in AI discourse comes from flattening different kinds of systems into one bucket — calling everything an assistant or everything an agent. The distinction that matters is between suggesting, collaborating, and coming back with work done:

• an assistant suggests
• a copilot collaborates inside a tight human loop
• a delegate is given a unit of work and expected to come back with an artifact, a recommendation, or a completed step

The labels themselves are less important than the operating difference, and the cleanest way to tell them apart is to ask where the human sits relative to the loop: in the critical path for every step, alongside the work in real time, or out of the loop until review. An assistant helps you think; nothing it produces takes effect until you have read it. A copilot lands its contribution inside a task already in motion, the way it completes the line you were already typing. A delegate steps you out of the moment-to-moment loop and back in at review, changing the state of the world even if only by producing work that others will rely on. A fast diagnostic: ask what happens if no human looks at the output for the next 24 hours. An assistant's suggestion goes stale — harmless, ignorable. A delegate's output has usually already changed something by then: a pull request opened, a record updated, a clock already running toward a deadline someone else now inherits. If the 24-hour-unread version of the system looks different from the assistant version, you are already past the assistant stage, whatever the product page calls it.

The book does not start with model intelligence in the abstract. Intelligence is necessary but insufficient. A system can be astonishing in conversation and still collapse the moment the user expects follow-through. Jacob Lauritzen, building legal AI at Legora, puts the break point bluntly: vertical AI and complex agents “need more than just the chat.” Sam Bhagwat makes the adjacent point from the workflow side. Once work becomes operational, the supposed opposition between agents and workflows starts to dissolve. The useful system is usually both.

The shift is not toward better chat but toward delegated execution, and delegation changes the failure surface.

A suggestion can be ignored. A delegated action can create rework. A bad summary can waste a few minutes. A bad patch can stall a release. A shallow legal draft can mislead someone who assumes the system already did the hard part.

Chat is the visible surface; the real system lives underneath

The text box remains important. It is usually the easiest way for a human to assign work, redirect a trajectory, or inspect an intermediate result. But once the task horizon stretches beyond a single turn, chat stops being the whole system.

A trustworthy delegate needs seven things chat alone does not provide:

• the right context, not just a large context window
• tools it can use without drowning in irrelevant options
• constraints that convert tacit expectations into explicit ones
• evaluation loops that catch drift before users do
• state that survives interruption, retries, and handoffs
• approval boundaries that let humans steer without micromanaging every move
• observability that shows what happened and what needs review next

This is why so many AI products keep escaping the chat box. They grow task lists, side panels, traces, approval queues, workflow views, memory layers, and tool catalogs. From the outside it can look like feature sprawl. Often it is something more basic: reality forcing the system to acquire a control surface equal to the work it claims to perform. Those organs are a diagnostic rather than decoration: when a serious agent product lacks one of them — a trace view, an approval queue — treat the absence as a reliability gap, not a leaner design, because a missing layer is usually where the workflow fails first. The important lesson is not that chat becomes irrelevant, but that it becomes one layer in a deeper stack.

That layering recurs at every level of the stack — the harness around a coding agent, evals and observability, context assembly, durable workflows, the human control plane. Each answers one question: what must surround intelligence before it is safe to delegate work to it?

Capability is not the same as dependable work

The AI field keeps relearning a painful distinction: demo capability and operational dependability are not the same thing. A model can look extraordinary in a controlled interaction and still fail as a working system. It can write code that seems right but violates a local convention nobody wrote down. It can retrieve relevant documents but miss the one paragraph that actually governs the decision. It can produce a beautiful answer while silently losing track of what happened two steps ago. It can look productive and still be impossible to trust. The test that separates the two is repetition, not a single impressive run: does the same request, phrased three different ways, produce the same dependable behavior when no one is watching closely enough to catch the drift? A demo only has to clear that bar once. A production system has to clear it every time, unobserved. That gap is what AI engineering exists to close.

Barry Zhang and Mahesh Murag at Anthropic are especially useful here because they resist the fantasy that raw model progress alone solves the problem. Their formulation is careful: agents “have intelligence and capabilities, but not always expertise that we need for real work.” The illustration is exact — you would not ask a 300-IQ mathematician to derive the 2025 tax code from first principles when what you need is an experienced tax professional’s consistent execution. Capability and expertise are different things, and the practical move is to supply the second deliberately rather than wait for the first to grow into it: package the missing context, conventions, and procedures as reusable skills the agent can load. Models got dramatically more capable. Expertise gaps did not disappear. Operational gaps did not disappear. The principle underneath is that capability amplifies whatever workflow it runs inside: a stronger model makes a good system better and a weak one more dangerous, because it generates more convincing output whether the surrounding workflow is sound or broken.

This is one of the book’s strongest anti-hype claims: in production AI, scaffolding is not a wrapper around intelligence but what makes it usable. That line can sound deflationary until you notice how much leverage it creates. If dependable systems come less from raw cleverness than from the environment around the model, then engineering matters enormously. Harnesses matter. Specs matter. Evals matter. Context architecture matters. Runtime semantics matter. Human oversight matters. The surrounding system is not bureaucratic drag on intelligence but the reason it can be trusted to do work.

The two recurring cases: the Software Factory and the High-Stakes Colleague

Two composite cases run through the argument — drawn from real patterns, not a single company — consistent enough that what happens in one chapter carries into the next.

The first is the Software Factory, anchored in a company we will call Meridian. Meridian is a mid-size fintech. It starts with an ordinary payments repository and a strong coding model. At first the agent feels magical on small tasks. Then the team expands scope and quality gets erratic. The model is not always the real problem. The deeper issue is that the workplace was never made legible enough for delegated machine work. The team has to add harnesses, specs, validation, context discipline, eval loops, runtime structure, and review surfaces. As it does, the repo starts behaving less like a chat playground and more like a managed production environment for machine labor.

This case shows how quickly "AI coding" stops being a prompt problem and becomes a systems problem.

The second is the High-Stakes Colleague, anchored in a firm we will call Hargrove. Hargrove is a mid-tier tax and advisory firm. Its assistant begins life as a helpful conversational surface that summarizes and explains. Then users ask it to do real professional work: assemble evidence, draft analysis, trace support, navigate internal knowledge, and operate under risk. Suddenly generic fluency is not enough. The system needs provenance, access boundaries, retrieval discipline, staged authority, durable trajectories, and explicit review points. It is no longer being judged as an answer engine. It is being judged as a professional delegate.

This case makes the trust question impossible to romanticize: in higher-stakes domains, "almost right" is often the most dangerous category.

The two cases follow the same transition across two kinds of work — one where the output is software, one where it is high-stakes professional judgment.

In both, the same pattern appears. The more valuable the delegated work becomes, the more the surrounding system starts to matter.

Delegation makes hidden judgment visible

Delegation also exposes how much good work always depended on tacit human judgment.

In the software case, that means local conventions, architecture taste, dependency discipline, rollback instinct, performance habits, and dozens of non-functional expectations that senior engineers usually carry in their heads. In the professional-services case, it means source hierarchy, provenance awareness, exception handling, domain caution, and judgment about when a result is not ready to trust.

Humans often mistake this tacit judgment for natural background competence because strong teams internalize it so thoroughly. But once work is handed to a machine collaborator, hidden standards become a liability. The system cannot reliably inherit what the organization never externalized, which sets the practical rule: a standard has to be made explicit before it can be delegated, or it will be violated silently. Cheap generation increases the value of judgment.

When code, prose, research notes, and drafts get cheaper to produce, taste does not become obsolete. It becomes more operationally important. The new scarce skill is not typing faster. It is setting standards, framing tasks, spotting slop, and knowing what good looks like before the system does.

What changes is not less craft but more visible craft.

AI engineering is the discipline of making delegation trustworthy

Once you accept that the real shift is from suggestion to delegation, a lot of the surrounding field stops looking fragmented. Prompting, retrieval, evals, workflow engines, guardrails, tool protocols, observability, sandboxing, policy files, and approval systems are often discussed as if they were separate subcultures. They are not. They are pieces of one broader discipline: making delegated machine work trustworthy enough to use.

That discipline keeps returning to a small set of questions. Can the system understand the environment it is supposed to operate in? Are the goals and constraints externalized well enough to survive handoff? Can the team tell whether the system is actually doing useful work? Is the model seeing the right information, in the right shape, at the right time? Can the work persist, recover, and expose itself to human supervision over time? Where should the system be free to act, and where must human judgment remain decisive?

AI engineering deserves to be treated as more than prompt craft or model selection. It is closer to distributed systems, product design, operations, and organizational design fused together around probabilistic components. Once the model is expected to do work, every surrounding layer becomes part of the product.

Trust under action is the governing problem

Whether models are impressive? They are. Whether chat is useful? It is. The harder question is this: under what conditions can a system act or produce on behalf of a user without quietly drifting out of bounds?

That is the governing problem because action changes everything. A product that only converses can survive with soft trust. A product that drafts, edits, executes, routes, retrieves, summarizes, recommends, or mutates real systems needs harder trust. It needs state, structure, reviewability, and control.

The book is also skeptical of autonomy maximalism. The goal is not to maximize agency in every direction. In many valuable systems, the right design is adjustable autonomy: let the machine move quickly where the risk is low and the checks are strong; slow it down where consequences are harder to reverse. Useful autonomy is not max autonomy but well-tuned autonomy.

Trust in AI is not mainly a matter of anthropomorphism or vibes. It is a property of system design.

What the rest of the book is really about

The chapters that follow are a cumulative answer to the same opening question, not a tour of trendy infrastructure.

• Chapter 2 asks what human craft becomes more valuable when execution gets cheap.
• Chapter 3 shows that delegated coding lives or dies on the legibility of the repo and the harness around it.
• Chapter 4 argues that delegated systems need a control loop, not just a few impressive successes.
• Chapter 5 argues that useful intelligence depends on building the right active working set, not merely shoveling more tokens into a window.
• Chapter 6 argues that long-running delegated work needs state, runtime semantics, and a human control plane.
• Chapter 7 argues that a high-stakes colleague can only be trusted with the identity and authority it actually holds.
• Chapter 8 argues that realtime and voice make every one of these problems harder, because the system must stay trustworthy while it is still talking.
• Chapter 9 argues that the organization, not the model, decides whether that trust compounds.
• Chapter 10 asks which of these commitments outlast the churn of models and tools.

The future of AI engineering is the gradual construction of dependable shared systems in which humans steer, machines execute, and trust is earned through architecture, not a pile of isolated tricks.

Closing move

The most important fact about modern AI is not that it can talk. It is that people increasingly want it to work.

They want it to return with artifacts, not just ideas; with completed steps, not just suggestions; with trajectories that can be inspected, redirected, and trusted. That desire raises the standard for the whole stack. A useful delegate needs context, structure, evaluation, durable state, and supervision. It needs engineering.

When coding agents disappoint, teams usually blame the model.

The model missed a dependency. The model misunderstood the architecture. The model refactored the right function but violated a local convention no outsider could have guessed. The model produced code that technically passed, yet somehow still felt wrong. In the postmortem, intelligence becomes the default suspect.

Sometimes that diagnosis is fair. Models do fail because they are weak, distracted, or simply not yet capable enough for the task. But in production codebases, that explanation is often too flattering to the humans involved. Many agent failures are not evidence that the model is hopeless. They are evidence that the environment was never made legible enough for delegated work.

Ryan Lopopolo puts the inversion bluntly: “The important thing is not the code but the prompt and the guardrails that got you there.” The line sounds almost rude in a field obsessed with generated output. But it captures one of the deepest shifts in AI-native engineering. Once you ask a machine to do implementation work instead of merely suggesting snippets, the surroundings become part of the product. The harness around the model starts determining what kind of work is even possible.

This chapter’s claim is simple: if you want AI to write production software, do not begin by asking what model to use. Begin by asking whether your repository, specs, validations, and workflow are structured well enough for a machine collaborator to operate without constant rescue.

A small software-factory vignette

Meridian started where many teams now start: with a good model inside an ordinary payments repo — the Software Factory the opening chapter promised, before it had earned the name. At first the results felt magical. The agent writes tests faster than the humans expect. It handles small UI changes cleanly. It can even land a respectable refactor if a senior engineer hovers nearby and corrects its misunderstandings in real time. So the team expands the scope. They ask it to wire together a new endpoint, touch a migration, update a frontend state machine, and preserve some vague house style that nobody has ever written down.

Quality immediately gets erratic. One patch uses a dependency the team would never approve. Another passes tests but ignores a performance convention learned the hard way six months earlier. A third is logically fine yet shaped in a way that makes review irritating and rollback risky. The team says the model is inconsistent. What they really mean is that the workplace is inconsistent.

So they change the workplace. They add explicit setup scripts instead of Slack archaeology. They tighten lint and type gates. They create agent-facing instructions. They check in examples of accepted patterns. They write slimmer task specs before handing work off. They stop relying on "everyone kind of knows how we do migrations here." The repo becomes less like a haunted archive of past decisions and more like a managed surface for machine labor.

Take one Tuesday from what the team would later call the slop era. A senior engineer hands the agent a migration: move three endpoints onto the new state machine, and keep the house style. The agent comes back in minutes with a clean-looking diff. It compiles. The tests pass. But it has pulled in a parsing dependency the team had quietly banned, and it batches writes inside a loop — exactly the pattern a payments incident taught them to avoid six months earlier. Neither rule was written anywhere the agent could read. The reviewer catches the dependency, misses the write pattern, and approves. The convention resurfaces later, in a review comment nobody will search again. None of it was a hallucination. The agent guessed because the workplace gave it nothing firmer to stand on. The next morning the team does the unglamorous work: a checked-in example of an accepted migration, a lint rule for the banned import, a setup script that ends the Slack archaeology.

That is the recurring case this book will call the software factory. It matters because it shows where the leverage really sits. The breakthrough is not that the model suddenly became a genius, but that the team stopped treating its own tacit judgment as invisible infrastructure.

The repo is the real interface

Most coding tools still present themselves through chat. You type a request, maybe select a few files, and wait for the assistant to propose a patch. That interface is useful, but it misleads by suggesting the real problem lives in the prompt. What actually determines the work is the environment around it — and unlike a prompt, an environment can be audited and improved.

In practice, the prompt is only the visible tip of a much larger system. The real interface is the codebase plus everything around it: the setup instructions, the architecture, the naming conventions, the tests, the lint rules, the examples of good patches, the traces of previous reviews, the ADRs, the failure cases, and the rules about performance or security that no single file states explicitly. A human engineer entering a mature repository absorbs these constraints slowly. They ask teammates what matters. They notice which patterns recur. They learn what kinds of changes get approved quickly and which ones trigger suspicion. An agent does not get that apprenticeship unless the team builds it.

Lopopolo makes the obligation explicit: “Your job is to build systems, software and structures that enable your team to be successful. And to do that, we need to make them legible to those agents that are driving the implementation.” That sentence is more radical than it first appears. It means the team is no longer only maintaining software for other humans. It is also maintaining a working environment for machine contributors. A cheap test for legibility: clone the repo into a fresh container and time how long an agent takes to reach a green test run. If it cannot — because step four lives in someone's shell history — that is a hole where the agent will guess.

That is why documentation, ADRs, examples, and historical breadcrumbs matter so much. Those are not decorative artifacts around the “real” software process; in an AI-native workflow, they are part of the execution environment itself. The rule underneath is unforgiving: a standard that lives only in scattered memory is one the agent cannot inherit, and will therefore break — in ways that look mysterious only because the team never externalized the standard the agent broke.

This is also why the practical unit of AI coding is no longer the snippet but the codebase. Naman Jain describes the shift cleanly: “My first project was actually working on generating single line... snippets and my last project was generating an entire codebase.” Once the unit of work becomes the repository, environment design stops being background hygiene and becomes first-order leverage.

The core mistake many teams make is to treat code generation as the primary problem and repo legibility as a secondary concern. In reality, the second often dominates the first. A capable model dropped into a murky repository is like a strong engineer dropped into an organization with no onboarding, inconsistent standards, and no access to prior decisions. You can still get lucky. You cannot count on it.

Good code contains hundreds of unstated decisions

One reason this problem is easy to underestimate is that experienced engineers are bad at seeing their own tacit judgment. Good code does not differ from bad code only in correctness. It differs in tone, proportion, naming, performance discipline, dependency choices, rollback safety, test shape, compatibility assumptions, reviewability, and fit with the broader system.

Lopopolo gives this problem a memorable scale when he says that producing a single patch can require “500 little decisions” around underspecified non-functional requirements. The exact number is not the point. The point is that repositories are dense with decisions that matter greatly but are rarely captured in the task description. A human engineer often fills those gaps through craft and context. A coding agent fills them through inference under uncertainty. Lopopolo names the mechanism: the models “during their training have seen trillions of lines of code that make every possible choice of those non-functional requirements that you could ever imagine.” Left a requirement unspecified, it samples one of those conventions, and nothing makes the sample yours.

Slop is not always the sign of a stupid model. It is often the sign of a task whose invisible success criteria were never written down. The agent guessed because the environment forced it to. Then humans act surprised that the guesses look generic.

Once you see the problem this way, the prescription changes. The answer is not only “prompt better”; it is to reduce the amount of silent guesswork that the environment demands. Externalize architecture choices. Store examples of accepted patterns. Make non-functional constraints explicit. Give the system stable ways to discover how this team expects software to be built.

That is what harness engineering really means. Not a fancier wrapper around a model, but the systematic conversion of tacit engineering judgment into durable, machine-usable constraints. Lopopolo describes the raw materials plainly — “leaving breadcrumbs, documentation, ADRs, persona oriented documentation around what a good job looks like” — and encoding them once buys reuse: have one engineer write down what a good QA plan looks like, and “every agent trajectory is going to get a good QA plan.”

Specs are not paperwork; they are executable intent

This is where spec-driven development becomes more than a documentation preference. In a purely human workflow, specs often compete with direct conversation. A strong team can get away with more ambiguity because engineers resolve a surprising amount through meetings, hallway discussions, pull-request comments, and local intuition. In an AI-mediated workflow, that ambiguity becomes more expensive. Context windows expire. Tasks get retried. Work gets decomposed into subproblems. Different agents touch different layers of the same system. Without persistent artifacts, intent keeps dissolving back into transient conversation. The operational test is whether intent would survive a fresh agent picking up the task cold; if not, it belongs in a persistent artifact, not the prompt.

Al Harris puts it plainly: “The spec then becomes the natural language representation of your system. It has constraints, it has concerns around functional requirements, non-functional requirements...” That framing matters because it upgrades the spec from document to control surface. Treating it that way has a concrete consequence: when the output is wrong, you fix the line in the spec that under-specified it and regenerate rather than hand-patch the output. Repeatedly editing code the next run overwrites is the signal that the spec, not the patch, is the thing to change.

Harris makes a second point that is just as important: spec-driven development is “a structured workflow that we push you through to reliably deliver high-quality software... requirements, design, and execution phases.”

A useful spec in an AI-native environment does several jobs at once. It records what problem is being solved. It states constraints the agent should not have to rediscover through trial and error. It makes room for non-functional requirements that are otherwise easy to drop. It persists across retries and handoffs. And it creates a shared object that humans and machines can both inspect.

Seen this way, specs are a form of context compression. They take sprawling intent that would otherwise live in chat history, tribal knowledge, or remembered conversation and package it into a stable artifact the workflow can keep returning to. They also make evaluation easier, because a system with a concrete spec can be judged against a clearer notion of success than one that began with a vague prompt and hope.

This does not mean every ticket needs an elaborate design doc. Over-specification can just as easily collapse exploration into bureaucracy, and some work is best discovered through fast iteration. The test is not how important the work feels but how expensive a misunderstanding would be: once the task is large, parallelized, safety-sensitive, or costly to review, explicit intent stops being ceremony and becomes leverage.

The deeper point is that spec-driven development matters more, not less, in an era of powerful coding agents. The stronger the generator, the more valuable a stable representation of intent becomes.

Agent-ready codebases are designed, not discovered

At this point the argument can sound abstract, so it helps to come back to repository mechanics. Eno Reyes is especially useful here because he connects old-fashioned engineering hygiene to an AI-native operating model. He begins with a deliberately basic question: “Do you have some automated validation for the format of your code?... for professional software engineers [it's] like, yeah, of course we do.” Then comes the important turn: “But I think you can go a step further.”

That extra step is the real substance of agent-readiness. The question is not simply whether a team has linting or tests, but whether the codebase has enough automated validation and explicit structure that a coding agent can move through it with bounded risk. A repository becomes agent-ready when it exposes enough of its standards, setup, and quality gates that delegated work becomes legible. The step further is that the validation surface is itself something the agent can extend: you can “ask a coding agent, could you figure out where we're not being opinionated enough about our linters” and have it write the missing rule. Reyes sets a low bar on purpose — “a slop test is better than no test” — because once a rough check exists, the next agent follows it and the rules ratchet tighter.

What makes a repo agent-ready is boring and concrete, and every item a team skips here is a place the agent will guess.

• a stable folder structure rather than a maze of historical accidents
• explicit setup, build, and run commands that do not rely on oral tradition
• strong type, lint, and test gates the agent can run repeatedly
• architecture decisions stored in files instead of buried in memory
• examples of accepted patterns for tests, APIs, migrations, and reviews
• specs or task briefs stored close enough to the work that they survive handoff
• narrower tools or scripts for common operations where free-form shell access is unnecessary

None of this is glamorous. That is exactly why it matters. The biggest gains in coding agents often come not from frontier prompting technique but from reducing avoidable ambiguity in the repository itself. Validation also caps how ambitious delegation can get: Reyes is explicit that you cannot fan out parallel agents until single-task execution succeeds nearly 100 percent of the time — if you cannot tell automatically whether one change is safe, running twenty only multiplies unverified output.

There is also an organizational benefit hiding inside this technical one. Better repositories do not only help machines. They help weaker humans, new hires, cross-functional contributors, and future maintainers. In that sense, “agent-ready” is not some alien new standard imposed by AI. It is a sharper test of whether the team actually encoded its own expectations in reusable form. The agent is exposing the difference between standards the team possesses and standards the team can operationalize. ## The harness is a workflow, not just a wrapper

It is tempting to imagine the harness as a thin layer around a model: maybe a system prompt, a tool list, a sandbox, and a few guardrails. That is too narrow.

A real harness includes environment setup, repository policy, validation steps, task decomposition, review surfaces, memory of prior work, failure handling, and the sequence in which all those things are applied. In other words, it is a workflow. Lopopolo's working definition names what ties those pieces together: “a good harness is really operationalized around giving the model text at the right time.” The unifying job is timing and selection — which file, rule, or example reaches the model at the step it needs it.

This is where the software-factory metaphor becomes useful. Eric Zakariasson titled his talk Building Your Own Software Factory, and the phrase lands because it redirects attention from one-off generation to staged production. A factory has specifications, stations, checks, feedback loops, and manager-visible status. It does not assume that every worker can safely improvise in every direction.

Zakariasson makes a subtler point too: the factory itself needs a spec. “To set the spec for the factory,” he says, you would likely have a folder in the codebase with markdown guidance, best practices, and rules. That is exactly the conceptual move this chapter needs. The harness has to be encoded somewhere. Once it is checked into the repo, process stops living only in human habit and becomes part of the codebase’s working surface.

Once you think in harnesses, you immediately care about evaluation and runtime semantics. A harness that cannot measure quality is incomplete. A harness that cannot preserve state across longer tasks is fragile.

Subagents and specialization belong to the harness

The same logic extends beyond a single agent. One of the most interesting developments in modern coding systems is the move toward specialized roles: research agents, review agents, refactor agents, debugging agents, and broader subagent frameworks that let a larger task be decomposed into parallel, semi-independent work. OpenAI’s Codex materials describe subagents as “the ability wherein you can spin off a master task into decomposable parallel and independent tasks.”

The key insight is not merely that parallelism can make things faster. It is that specialization makes process explicit.

When a team creates a dedicated review agent, a repo-auditing agent, or a migration-focused agent with narrow tools and instructions, it is encoding judgment about how work should be done. The role itself becomes part of the harness. This mirrors what strong human organizations already do. They do not treat every task as a blank slate executed by a generalist. They create roles, review structures, and bounded responsibilities so judgment can scale.

But subagents also intensify the need for good scaffolding. More workers without a stronger harness do not create a factory. They create chaos faster. Parallel output is only valuable if the pieces can be recomposed, inspected, and evaluated. That means subagents are not an argument against harness engineering but evidence that it is becoming more important.

The new advantage is environment design

AI coding tools market the visible magic of generation — the agent edits a file, writes a test, proposes a patch. Those moments are real and often impressive.

But the durable advantage is increasingly elsewhere. It belongs to teams that make their repositories legible. Teams that externalize non-functional judgment instead of leaving it trapped in senior engineers’ heads. Teams that treat specs as reusable intent rather than ceremonial paperwork. Teams that invest in validations and repo affordances that help an agent check its own work. Teams that gradually turn loose process into a staged, inspectable software factory. Reyes puts a specific number on the stakes: this investment is where “the real like 5x, 6x, 7x comes from,” and the catch is that “it's a choice that you as an organization have” — the model will not hand it to you.

This is why harness engineering deserves to be treated as a primary discipline instead of a tactical trick. The harness is not a helper around the codebase. It is becoming part of the codebase.

The winners in AI coding will not simply be the teams with access to the strongest models. They will be the teams that built workplaces those models can actually understand.

Once the environment can produce delegated work at all, the next question is no longer how to generate more. It is how to know whether the generated work is actually good.

Useful AI systems do not fail only because the model is weak. They fail because the system cannot assemble the right working set of information at the right moment, in the right shape, at a cost the product can bear.

As long as AI felt like a prompting game, context looked like an input-field problem. You had a box, a token limit, and a growing collection of tricks for stuffing more things into it. Add a few retrieved documents. Paste a spec. Prepend some examples. Tell the model to think harder. But that framing gets the problem backwards. Context is not the garnish around intelligence. It is the substrate that determines what the system can even notice.

That becomes obvious the moment you leave toy tasks. A coding agent needs the right files, the right rules, and the right execution history. A research agent needs the right sources, not just more sources. A legal or enterprise assistant needs proprietary context, structured evidence, and a way to separate active working memory from archival knowledge. And once tools enter the picture, the problem gets harder still. Suddenly the system is not only choosing which documents to retrieve. It is choosing which capabilities to expose, how to describe them, and how to avoid drowning the model in a giant catalog of possible actions.

This is why the next generation of AI systems is being shaped less by prompt cleverness than by context architecture. Retrieval, memory, GraphRAG, enterprise knowledge layers, tool schemas, capability grouping, and token-budget discipline are all parts of the same deeper problem: deciding what the model should see, when it should see it, and what must stay out of the way.

The active working set matters more than the raw knowledge base

One of the most persistent confusions in AI product work is the assumption that having access to more information is basically the same thing as having better context. It is not.

A company may have millions of documents, a codebase thousands of files, a legal system a vast corpus of precedent and prior work product. None of that guarantees the model sees the right few things for this task, in this turn, under this deadline.

That distinction sounds obvious once stated, but teams violate it constantly. They talk as if the problem were solved the moment the system can technically reach the knowledge. Then the product disappoints and the blame falls on the model. In reality, the model often failed because the system handed it the wrong working set: too much, too little, or the right ingredients in the wrong order.

Jack Morris puts the correction in a talk title — stuffing context is not memory, updating weights is. Shoving more tokens into the window is not a serious theory of knowledge use; it is closer to panic than architecture.

Nupur Sharma’s Qodo work gives the mechanism behind it. Models privilege the start and end of the window and degrade in the middle, so a longer prompt does not buy more attention; it buys a wider blind spot. Her detection cue is concrete: when accuracy drops as you add more retrieved documents rather than rising, you are watching the middle get dropped, and the fix is assembly — summarization, graphs, iterative retrieval — not a bigger window.

Daniel Chalef makes a related point from the memory side. Teams often use retrieval as a universal substitute for state, history, and durable understanding. But memory across time, archival knowledge, and the active context surface are not the same layer. An agent may need all three, yet each has different update rules, different freshness requirements, and different failure modes.

The practical unit of context engineering is not the total corpus but the active working set. The question is not, “What can the model access in principle?” The question is, “What should the model be looking at right now to do this job well?” That is a much stricter engineering problem.

Kuba Rogut puts the sizing rule in one line, relaying Jeff Dean: you do not need a trillion tokens at once, you need the right million. The number worth instrumenting is not how big the index is but how little of it the answer needed.

Context is selection, shaping, and timing

Once teams stop equating context with raw access, a second clarification becomes necessary. Context engineering is broader than retrieval.

Retrieval matters. Search quality matters. Ranking quality matters. Chunking matters. But a production context system also has to shape the evidence, compress it, layer it, and decide when it should appear in the workflow. Sometimes the right move is to retrieve the most relevant source. Sometimes it is to retrieve three sources, summarize two, and keep one verbatim because wording precision matters. Sometimes it is to avoid retrieval altogether and carry forward a structured state object produced in the previous step.

Val Bercovici’s phrase “context platform engineering” is useful precisely because it elevates the problem out of prompt folklore and into systems design. If your system has to support many tasks, many agents, many tools, and many data sources, then context becomes something you engineer, budget, version, and monitor.

This is where a lot of otherwise promising AI products become strangely fragile. Their context logic is accidental. They have a search call, a prompt template, and a rough hope that relevant things will land in the window. The product may work beautifully on easy questions and then fall apart on the exact tasks that matter most: cross-document synthesis, multi-hop reasoning, domain-specific exception handling, or cases where one irrelevant chunk quietly crowds out the one paragraph that actually governs the answer.

The failure often gets described as hallucination. Sometimes it is. But just as often it is context misassembly.

That distinction matters because the remedy changes. Hallucination invites better model behavior. Misassembly invites better infrastructure.

The High-Stakes Colleague needs more than access

Hargrove’s tax practice makes the stakes of this chapter especially clear. The firm’s assistant began life as a helpful chat surface — the High-Stakes Colleague the opening chapter named, before anyone asked it to do the work. It summarizes documents, answers questions, and cites plausible authorities. Users like it. But after the novelty phase, they ask for something harder. Not “help me think,” but “help me do the work.” Draft the note. Compare the clauses. Trace the missing support. Walk the evidence chain. Tell me not just what this document says, but what matters across the relevant documents for this client, this issue, and this jurisdiction.

At that point, generic model intelligence is no longer the bottleneck. The bottleneck is whether the system can assemble professional-grade context.

Chau Tran’s enterprise framing is useful here because it refuses the fantasy that an LLM becomes enterprise-aware by being merely smarter. A brilliant new employee is still ineffective on day one if they cannot find the internal wiki, do not know which document system matters, and cannot tell policy from draft from folklore. The same is true of agents.

This is where the book’s second recurring case, the High-Stakes Colleague, becomes more than metaphor. The system is valuable not because it can speak elegantly about law or tax, but because it can operate inside a domain where evidence provenance, internal knowledge, and retrieval discipline materially change the quality of work.

In Harvey’s and related legal-frontier material, the problem is not only finding relevant text. It is finding the right text in the right topology: internal precedents, authoritative sources, matter-specific files, note trails, citations, and the relationships between them. The difference between “broadly relevant” and “operationally decisive” can be a single paragraph hidden in the wrong layer.

Watch one request from Hargrove’s early build-out. A tax associate asks the assistant to trace the support for a deduction a client has claimed for years. The assistant answers fluently and cites a clean-looking authority — a public explainer whose wording matches the query almost perfectly. It reads as decisive. It is also wrong for this client: the governing position lives in a matter note a senior attorney wrote earlier, in a different file, under a jurisdiction the explainer never mentions. The system ranked it first because nothing told it a public article and a matter-specific note are not the same kind of evidence. The remedy is not a smarter model. The team types its knowledge topology into the system: source typing that ranks internal precedent above public background, access boundaries per matter, and a retrieval surface that carries provenance, so the associate can see which layer an answer came from. The misranked matter note becomes the scar the rest of the build-out is designed around.

Hargrove’s context system needs more than a document dump. It needs access boundaries, source typing, freshness policies, ranking tuned to domain use, and interfaces that preserve provenance. In high-stakes work, a system that is 90 percent right for unclear reasons can still be professionally unusable. The issue is not whether the model knows a lot, but whether the product can build a trustworthy evidence surface around the model.

Context topology determines usefulness

The phrase context topology may sound abstract, but the idea is concrete. Different kinds of information should not all be treated as interchangeable text.

A company handbook is not the same as a CRM record. A draft contract is not the same as signed language. An old Slack discussion is not the same as a policy. A code spec is not the same as the code itself. A matter note written by a senior attorney is not the same as a general explainer article pulled from a public source.

Yet simplistic retrieval systems flatten all of these into one big searchable pile. They act as if the only problem were semantic similarity.

In practice, usefulness depends on topology: what kind of thing this is, how it relates to other things, how trustworthy it is, how recent it is, whether it is active or archival, and whether the current task calls for literal quotation, background orientation, or cross-source synthesis.

This is one reason context engineering is so often misunderstood by teams that are still thinking in terms of “RAG versus no RAG.” Retrieval-augmented generation is one mechanism. Context topology is the broader design problem.

A serious context architecture keeps these layers from collapsing into one searchable pile:

• authoritative sources versus helpful background
• current task state versus long-term memory
• private internal knowledge versus public reference material
• raw evidence versus summaries derived from prior steps
• tool outputs that should be inspected directly versus ones safe to compress

Once those layers are explicit, the system can behave less like a desperate search box and more like a disciplined colleague assembling a working binder.

That image is useful because it makes the design standard obvious. A strong professional does not walk into a meeting carrying every file the firm has ever touched. They carry the current binder, the active notes, a few precedents, and a clear sense of what counts as governing authority. Context systems should aspire to the same selectivity.

Chau Tran’s Glean work makes that selectivity operational. Much of it is filtering on signals the corpus already carries — the user’s permission scope, the freshness of the source, the document’s role in the organization — applied before the reranker, so material the task should never see never reaches the window. Rank on raw embedding similarity alone and the system will happily surface a deprecated wiki page that reads almost exactly like the current one.

Graphs matter when evidence must be assembled, not merely fetched

There is a predictable cycle in AI infrastructure where one technique gets overhyped, then mocked, then quietly absorbed into mature practice. GraphRAG is in some danger of following that path.

The right way to think about graphs is neither as magic nor as marketing garnish. They matter when the task punishes shallow retrieval.

Nearest-neighbor search is often enough when the user wants one relevant passage. It becomes less sufficient when the work depends on relationships: this clause belongs to this agreement, which sits inside this matter, which has a related note, which references an exception in another source, which only matters for this entity and date range. That is not merely a document-matching problem. It is an evidence-assembly problem.

Stephen Chin and the Neo4j material are useful here because they make the structure visible. Knowledge graphs can help with multi-hop synthesis, entity disambiguation, and the recovery of relations that ordinary chunk retrieval tends to flatten away. The point is not that every product needs a graph. The point is that some tasks require a representation richer than bag-of-passages search.

This is especially true in enterprise and legal settings, where what matters is often not a single answerable sentence but a traceable path across entities, documents, and prior decisions. Hybrid retrieval becomes attractive because the right mechanism follows from the shape of the answer: vector search when the answer is a single similar passage, graph traversal when it is a path along explicit relationships, keyword or metadata filters when exactness is what matters. Mature systems layer all three rather than declaring one winner. The key chapter-level claim is simple: context quality depends on how well the system assembles evidence, not only on whether it retrieves something related.

Memory is not the same thing as a long prompt

The longer agents operate, the more tempting it becomes to treat the context window as a backpack that just keeps getting bigger. That instinct is understandable and usually wrong.

Hierarchical memory is a better mental model. Some things belong in immediate working memory because they are needed right now. Some belong in session history because they explain how the current state was reached. Some belong in durable long-term memory because they recur across tasks. Some should not be carried at all unless explicitly reintroduced.

This matters because every piece of carried-forward context has a cost. It occupies tokens. It competes for attention. It increases the chance that stale, irrelevant, or misleading information will quietly shape the next step. Bigger windows reduce one kind of pressure, but they do not remove the need for disciplined selection.

Most of that budget hides in the input. Rajkumar Sakthivel’s team at Tesco states the decomposition bluntly: “90% of your AI cost is input. Files, search results, context you send in. Only 10% is output.” It inverts the usual instinct to reach first for a cheaper model: the model may be 30 percent of the cost, and what you feed it the other 70. Indexing a codebase and retrieving only the relevant slices, instead of pasting whole files, cut input tokens by 94 percent on their public benchmark — a best case measured against always reading whole files, which he is careful to say real setups will not match.

The software-factory case already hinted at this in Chapter 3. An agent working in a repo does not need the whole codebase in active view. It needs the right files, the relevant specs, and enough execution history to avoid losing the thread. Chapter 4 sharpened the same point from the measurement side: the system must preserve the right failures and slices. Chapter 5 extends the logic. Good context architecture means knowing what to keep live, what to summarize, what to index, and what to leave out. That restraint is not weakness but design maturity.

MCP turns context into a capability-management problem

The rise of tool protocols such as MCP exposes a newer version of the same issue. For a while, context engineering mostly meant “Which documents should the model see?” Now it also means “Which tools should the model know exist, how should they be described, and how do we prevent the capability surface from becoming its own form of overload?”

Matt Carey’s talk title names the trap precisely: the MCP mega context problem. If every tool, every parameter, every capability description, and every server is naively dumped into the model’s working view, the system becomes less usable, not more. We should not confuse optional power with available focus.

Sam Morrow’s lessons from GitHub’s remote MCP server push the point from diagnosis into operating practice. Progressive discovery, grouping, intent-aware exposure, and ruthless context reduction are not polish. They are core product decisions. The model should not receive a phone book of capabilities when what it needs is a small, discoverable menu relevant to the current task.

GitHub’s own numbers make the practice concrete. When community contributions pushed that server past a hundred tools, the agents got measurably worse. The first fixes were elegant opt-in machinery: tool sets and dynamic discovery. Almost no one used them, because most users never touch the JSON config — the load-bearing lesson being any fix that depends on user configuration reaches a minority, so change the default instead. GitHub did, cutting the initial tool-load context by 49 percent. The number of tools the agent could call did not fall; the number it had to read did.

Tool access is not merely an integration story. It is part of the same infrastructure problem as retrieval, memory, and evidence assembly: deciding what the model should see and what it should not.

The old failure mode was “the model lacked the right document.” The emerging one is “the model was buried under too many possible actions.”

Context quality is measured downstream

A lot of context discussions drift into architecture diagrams too quickly. The diagrams can be useful, but they also create a form of intellectual camouflage. A beautiful retrieval stack can still produce mediocre work. A graph-enhanced pipeline can still be badly ranked. A memory subsystem can still carry forward the wrong state. An elegantly standardized tool protocol can still swamp the model with irrelevant capability descriptions.

The only reliable proof of context quality lives downstream, which is the acceptance test any context change has to pass:

Does the system complete real tasks more accurately? Does it cite better evidence? Does it reduce review burden? Does it waste fewer tokens to get the same or better result? Does it make higher-stakes workflows feel more trustworthy rather than more theatrical?

Evals tell you whether your context architecture is actually helping. Observability tells you where context assembly failed in production. The two are inseparable. A clever-looking retrieval trace proves nothing; you know the context system is good because the work improves.

That inseparability implies a specific eval design: score retrieval and generation separately. Track whether the governing passage reached the assembled working set at all — a recall measure on the context layer — before scoring whether the model used it correctly. Score only the final answer and a context-assembly bug looks exactly like a model getting dumber — and a model upgrade gets wasted on a retrieval problem.

So many context debates stay unproductive because they happen in the abstract. Teams argue about RAG, GraphRAG, memory, or tool selection as if these were ideological camps. In production they are just means, and the downstream test decides between them: the assembly that makes the delegated work more accurate is the right one.

A stronger model amplifies both good and bad context

There is a temptation, especially among people impressed by raw model progress, to treat context work as secondary plumbing. If the model keeps getting smarter, surely the need for elaborate context engineering should diminish.

In practice the opposite often happens, and the rule is worth stating plainly: a stronger model raises both the return on good context and the cost of bad context. It does more with the right evidence, tools, and state placed in front of it, and it generates more persuasive nonsense when the context surface is badly assembled. Capability amplifies both outcomes, which makes a better model a reason to invest more in context, not less.

That is why context belongs in the same mental bucket as harnesses, evals, runtimes, and security. It is not a prompt trick but one of the engineered surroundings that determine whether intelligence becomes useful.

A machine colleague does not need infinite information. It needs the right binder.

Once the binder is assembled, something has to keep the work alive across time: remembering what happened, what waits for approval, which tool ran, and what the human must inspect next. That is the runtime problem, the next layer of infrastructure.

A helpful model can get away with being vague about power. An acting system cannot.

The moment an AI system can read across accounts, call tools, execute code, trigger workflows, or continue working after the user has moved on, trust stops being a soft judgment about how smart the model sounds. It becomes a hard architectural question. Who is this system acting as? What can it reach? What can it do without asking again? What happens if it is manipulated? What evidence remains after the fact? And how quickly can that power be reduced, revoked, or redirected when something goes wrong?

Chapter 6 argued that long-running delegated work needs a human control plane. This chapter adds the next constraint: a control plane without authority boundaries is still not trustworthy. Durable execution tells you what the system is doing over time; security determines whether it should have been allowed to do it at all.

The core mistake in immature agent systems is to treat tool access as a product feature before treating delegated authority as a systems problem. That works for demos because the happy path flatters the design. The agent seems capable. It reaches many systems. It stitches steps together. But the same freedom that makes the demo look magical also enlarges the blast radius of every prompt injection, every misread instruction, every overscoped token, and every badly described tool.

Agency turns security from request control into workflow control

Traditional application security had a relatively stable unit of action. A user clicked a button. An API call hit a service. The backend checked permissions. The path was constrained enough that teams could reason in discrete requests. Agency dissolves that unit: the architecture must now constrain the whole delegated workflow, not decorate prompts around isolated requests.

Agentic systems weaken that comfort. An agent does not only receive a command. It interprets intent, decides how to pursue it, fans out into tools, retries when steps fail, and may continue moving through a workflow long after the original prompt is gone from the user’s attention. The trust boundary therefore expands. The key question is no longer only whether a given user may access a given resource. It becomes whether a delegated machine actor can decide, retrieve, execute, and continue safely on that user’s behalf. That is a much larger surface.

The High-Stakes Colleague makes the shift obvious. In legal, tax, and compliance workflows, the system is not merely answering a question. It may gather evidence, traverse internal sources — the same retrieval binder it assembled in Chapter 5 — use the validation engines it gained in Chapter 6, draft conclusions, and surface a recommendation for human sign-off. The risk lives across the trajectory, not at one tool endpoint. A single misstep in that chain can leak the wrong document, overstate a conclusion, or cross a permission boundary that the human did not realize had been delegated. What Chapter 5 answered with provenance, security now answers with authority: who authorized that path?

In high-stakes work the risky move is often not one bad answer. It is a system quietly crossing from assistance into authorization inside a competent-looking trajectory.

The Software Factory exposes the same problem from another angle. A code agent with repository access is not dangerous only when it writes a bad patch — the quiet, special-path kind the admin-override regression of Chapter 4 already paid for. It is dangerous when it can quietly inspect secrets, mutate CI configuration, add a dependency, call external services, or keep iterating after a misleading instruction entered the loop. Once code execution enters the picture, the old fantasy that trust can be solved primarily at the prompt layer becomes hard to defend.

Sandboxes matter because models are not where trust ultimately lives

The clearest lesson from the code-execution material is a rule, not an observation: a model can never be the final enforcement layer for its own power.

If an agent can execute code, browse untrusted content, open files, or chain across tools, then the design must assume it can be induced into bad behavior. Maybe by a malicious instruction. Maybe by a poisoned page. Maybe by a bug in tool descriptions. Maybe by a simple misunderstanding. The source of failure matters less than the consequence.

Sandboxing is therefore part of the product, not an implementation detail. A serious code-executing agent should run in a constrained environment. Filesystem access should be scoped. Network access should be explicit. Secrets should be minimized. Tool permissions should be narrow by default. Risky operations should require step-up approval rather than inheriting broad ambient authority. If the system needs to browse arbitrary inputs, those inputs should not sit on the same trust plane as production credentials.

Fouad Matin's security guidance for coding agents at OpenAI names four controls as the default-on baseline, not hardening added after an incident: sandboxing, network restriction, privilege boundaries, and human review. Each bounds a different failure — a bad command, exfiltration, over-reach when the agent is wrong, and the trajectory the first three let through.

This is an old security instinct, but agent systems give it new urgency. In classic software, code paths were written by developers and at least somewhat knowable in advance. In agentic software, the system is choosing among many possible paths at runtime. That makes deterministic boundaries even more valuable. The model may improvise, but the environment should fail closed.

This is also why security-heavy discussions increasingly sound like runtime design rather than model evaluation alone. They are about OS boundaries, execution isolation, token scope, credential lifetimes, and mediation layers. They are about what the system can do even when the model is confused, manipulated, or simply too eager.

The underlying principle is blunt: assume the agent will sometimes be wrong, and build so that being wrong is survivable.

There is a serious discipline devoted to the model’s own alignment — what it is disposed to do, refuse, and value — and nothing here argues against it. This book is about a different layer: the engineering that surrounds the model — the boundaries, identities, sandboxes, and audit trails that must hold even when the model’s inner alignment is imperfect.

Least privilege becomes a product design discipline

Least privilege is easy to praise and surprisingly hard to operationalize in agent systems.

A useless agent can be perfectly safe. The challenge is to make the system powerful enough to matter without giving it so much authority that one mistake becomes expensive. This is where many teams discover that access control is no longer a back-office function. It becomes part of the product experience.

A strong design does not expose every tool and every permission up front. It gives the system a constrained initial surface, then expands authority only when the workflow truly requires it. GitHub’s production lessons point in this direction — scoping what the system can see based on existing credentials, filtering tool exposure by permission, using step-up flows for stronger actions. That pattern matters because it treats tool discovery and authorization as connected problems. OpenAI's Fouad Matin describes the same least-privilege default for code-executing agents: the sandbox by design means "it can only read and write files within the directory that it's run in."

A scope that looks harmless in isolation can compound once it is paired with retrieval, reasoning, persistence, and retries. The sharper question for an agent is not only what the minimum access is, but minimum access for which stage of the workflow.

The same logic is really a default-permission table, one row per agent. A research agent may not need write access at all. A support agent may need to read account metadata but not issue refunds. A legal workflow may need broad retrieval across documents but no authority to send anything externally. A scheduling agent may need access to calendars yet no permission to message third parties without confirmation.

Narrower powers do more than protect the organization; they reduce the number of tempting but unsafe paths the model can wander into. A better security design often makes the system easier to reason about, not only safer.

Safe delegation comes from making carelessness less powerful, not from asking the model to be careful.

MCP and standardized tool access do not remove governance; they raise its stakes

Standardized tool access is genuinely useful. It lowers integration friction. It gives model-facing systems a common way to discover capabilities. It reduces the amount of one-off glue every vendor has to invent. All of that is real progress.

But interoperability does not dissolve governance problems. It concentrates them.

Once many tools can be exposed through a common protocol, the main bottleneck moves upward. Teams no longer ask only, “Can we connect this service?” They start asking, “Should this be exposed at all? To which agents? Under which identities? With what logging, discovery rules, consent surfaces, and policy constraints?” The protocol solves the wiring problem and reveals the management problem.

Tun Shwe at Lenses puts the production reality plainly: "Your insecure MCP server won't survive production." The failure modes are mundane and repeatable — authentication treated as a configuration option, tool descriptions trusted as input, servers exposed publicly because internal routing was the harder problem. A useful test: if adopting a protocol raises the number of capabilities your agents can reach faster than your team can answer who can call this, with what scope, and where it is logged, standardization has expanded the attack surface.

The enterprise MCP discussions keep the book from confusing integration ease with production readiness. The easier it becomes to connect tools, the more pressure builds for curation, grouping, authorization, visibility, and roots of trust. The system needs to know not only what exists, but what is blessed, what is risky, what is scoped to a team, and what requires escalation.

This also connects back to Chapter 5. Context overload and capability overload are cousins. A model flooded with too many possible tools is not only inefficient. It is harder to govern. Progressive discovery, capability grouping, and mediated exposure help both cognition and security at once.

A mature tool ecosystem therefore does not eliminate chokepoints. It creates better reasons for them.

Enterprises keep reinventing gateways because gateways solve several problems at once

Developers often prefer directness. Connect the agent to the tool. Let the model call the thing. Keep the stack simple. Organizations with real risk tend to rediscover a different preference: mediated access.

Whether it is called a gateway, a policy plane, an identity hub, or a root of trust, the pattern keeps returning for understandable reasons. A trusted mediation layer can centralize auth, narrow credential handling, standardize policy enforcement, capture logs, and provide one place to revoke or reshape access when the environment changes. It can also make security teams less allergic to agent adoption because they are not being asked to bless an uncontrolled mesh of direct tool connections.

Karan Sampath at Anthropic names the requirement directly: security teams "need to establish a root of trust" at the platform, not at each individual tool. The shape that satisfies it reads as a checklist — a gateway, a policy plane, a registry of blessed servers reviewed before entry, a permissions model over identities and tools, and an audit log at the gateway layer. A missing one is the likeliest place for the boundary to fail first.

This is not bureaucracy for its own sake. It is a response to what delegated machine work actually does inside institutions. Once many tools, many users, many teams, and many workflows are involved, local convenience stops being the only design goal. The organization needs consistent trust infrastructure.

The High-Stakes Colleague is again the clearest mirror. A professional workflow is only trustworthy if the surrounding institution can answer basic questions reliably: who authorized this path, what authority was used, what evidence was consulted, and what policy applied when the system crossed into a consequential step? A gateway pattern makes those questions cheaper to answer.

The same is true in the Software Factory. A central access and policy layer can decide which repositories, environments, and operations are exposed to coding agents at all. It can keep risky powers off the default path. It can make the difference between a coding assistant that is merely fast and a software factory that is governable.

Identity for agents is really the problem of delegated authority

The hard problem is not only authenticating the human user. It is safely carrying that user’s authority across multiple systems while preserving scope, duration, attribution, and revocation. The agent has to act on someone’s behalf without becoming an unbounded extension of their account.

The most common shortcut makes the gap concrete: hand the agent a standing credential — a long-lived API key, or a personal access token borrowed from the operator. A standing credential is not a delegation. It is the agent inheriting the borrowed key’s whole authority, with no scope to revoke and no expiry that maps to the task.

The system must know four things: who the human is. What powers the agent has been granted. How long those powers last. How those powers can be withdrawn or narrowed.

That is what makes delegated identity different from ordinary session management. A human being can interpret context, notice risk, and stop themselves. An agent can move faster and across more surfaces, but it is less inherently trustworthy. So the identity system has to carry more of the burden.

This is why repeated ad hoc consent flows are not just annoying UX. They signal a deeper architectural gap. If every tool asks separately, the organization loses coherence. Users get habituated to clicking through permissions they do not fully understand. Security teams lose visibility into the aggregate authority the workflow has accumulated. The agent itself becomes a messy stack of partially granted powers rather than a cleanly governed delegated actor.

Patrick Riley and Carlos Galan at Auth0 frame the fix: "we authorize agents, MCP servers" — the agent becomes a first-class principal with its own scopes, lifetime, and revocation path rather than riding on a human’s credential. Jared Hanson at Keycard argues the same shape: the right agent credential is a short-lived, scoped token bound to a session, a user, and a task. An agent authenticated as a blurry extension of a human is not delegated; it is impersonating.

Cross-app access patterns and identity-provider mediation are attractive because they acknowledge that this sprawl will not scale. If agents are to become real workers inside enterprises, they need identities and authorization paths that are as manageable as those of human workers, while still being more bounded.

That phrase matters: more bounded, not less. Nobody grants a junior employee universal access to every internal system on day one. The same common sense should govern agents.

High-stakes trust depends on inspectability as much as prevention

Security discourse often focuses on blocking bad actions, but blocking is only half the requirement.

In high-stakes environments, trust also depends on being able to reconstruct what happened. Which sources were consulted? Which tool calls were made? Which permissions were exercised? Which output did the system present for review, and what path led there? If an answer is disputed, if a workflow failed, or if a regulator asks questions later, the organization needs more than a statement that the model was generally aligned. It needs evidence.

Observability is part of the security argument, not a separate one. Rich traces, approval logs, trajectory views, and reviewable histories are not only operational conveniences; they let an institution convert bounded autonomy into something defensible.

Joel Hron’s high-stakes framing is especially powerful here because it does not pretend the answer is unrestricted autonomy under perfect prevention. The answer is constrained execution plus inspectable paths. The system can do meaningful work, but it leaves behind a trail that domain experts and organizations can actually examine.

Consider the day a client disputes a position Hargrove’s assistant helped file. A partner must answer one question: what did the system actually do? Because the assistant reached its documents through a mediation layer, the answer exists. The trajectory shows which matter files it retrieved, which validation engine it called, and which draft it surfaced — all under a read-only token scoped to this matter, with no authority to send to the client. Without that trail, the honest answer would be a shrug. Inspectability here separates a defensible workflow from a liability the firm cannot bound.

That said, none of this is simple. Inspectability creates its own tension. Detailed traces can expose sensitive data, internal reasoning artifacts, or privileged content. A trustworthy architecture therefore needs selective retention, role-based visibility, redaction strategies, and different surfaces for operators, reviewers, and auditors. But that tension is not an argument against inspection. It is an argument for governing inspection properly.

Trustworthy autonomy is tuned, not maximized

A childish architecture asks, “How much can we let the agent do?” A mature architecture asks, “What authority is appropriate at this step, for this domain, under this level of risk?”

That distinction matters because it ties security directly to product seriousness. In the High-Stakes Colleague, the system is valuable precisely because autonomy is dialed. It can retrieve, synthesize, validate, and draft, but some transitions remain deliberately human. In the Software Factory, subagents can search, summarize, patch, and test, while merge rights, deployment actions, or broader environment changes remain gated. In both cases, trust comes not from proving the system can do everything, but from deciding what it should never do casually.

This is what high-stakes trust actually looks like in practice: layered controls, bounded identities, narrow permissions, mediated access, sandboxed execution, and enough visibility that a human institution can remain responsible for the work.

Security is the architecture of deserved trust

Once AI systems act, security cannot remain a sidebar to product capability. It is the architecture that determines whether delegated power is deserved.

Identity tells the system on whose behalf it acts. Authorization determines which powers it actually holds. Sandboxing and least privilege contain the damage when the model is wrong. Gateways and roots of trust turn sprawl into governable infrastructure. Audit trails and inspectable trajectories turn machine action into something institutions can review, defend, and improve.

A machine colleague is not trustworthy because it sounds confident. It is trustworthy only when its power has shape.

The next chapter asks whether bounded authority still holds when the room stops being calm — when the human is still present, the clock is running, and every defect in the architecture becomes audible.

The biggest gains from AI do not come from giving individuals better tools. They come from redesigning the organization so delegated machine work can compound instead of colliding.

That distinction matters because many AI adoption stories still start too small. Someone buys a seat. A few engineers get faster. A product manager drafts more quickly. Support summarizes tickets with less effort. A consultant uses AI to speed up research. These changes are real, and sometimes valuable, but they do not yet amount to an AI-native organization. They are tool-use stories. They describe local acceleration, not institutional redesign.

An AI-native organization begins later, at the point where the work itself changes shape. Execution gets cheaper. Exploration gets faster. More people can create artifacts that previously required specialist intermediaries. Individual operators can direct several agents in parallel. Teams can investigate more options before committing. And almost immediately, a new set of bottlenecks appears. Review load rises. Duplicate work spreads. Private agent workflows drift out of sync with shared priorities. Standards become harder to enforce informally. Managers can no longer assume that the org chart maps cleanly to who is able to produce what.

This is the deeper lesson. AI does not merely accelerate output. It reorganizes where scarcity lives.

Scarcity moves upward: from typing to judgment, from production labor to orchestration, from drafting to deciding which draft deserves trust, from isolated productivity to system throughput. The practical test is to find the step where work now piles up waiting on a person; that queue marks where scarcity moved, and it is almost never the keyboard. Once delegated work becomes real, organizational design becomes the macro-scale version of harness design.

A Monday morning scene from the software factory

Over a weekend at Meridian, a company well past casual AI adoption, engineers launched subagents against backlog items. Product used internal tools to spin up three alternative flows for a new onboarding step. Support discovered a recurring customer complaint and had an agent draft both a help-center update and a proposed product fix. A staff engineer woke up to twelve pull requests, four synthetic eval reports, two security review requests, and a dashboard showing that an internal automation quietly touched three systems nobody had discussed together on Friday — any one of which could be hiding another admin-override regression, the throttle on the wrong path from Chapter 4, now buried under a weekend of green checkmarks.

Read back through that scene and you will not find a single reckless act — each move is locally defensible, everyone is productive — and that is the problem.

The organization is no longer starved for output. It is starved for coherence. Which of these changes matter? Which ones are duplicates? Which artifacts reflect the current strategy and which ones reflect a private interpretation of it? Which outputs are safe to merge, safe to trial, safe to ignore, or dangerous to trust? Who is even responsible for saying so when authorship is now half human, half machine, and spread across several functions? The order is not arbitrary: settle ownership first, because every other question needs someone empowered to answer it; then strategy fit, which discards whole branches cheaply; then safety-to-merge, the expensive per-artifact check you want to run last and least.

This is where the software factory stops being just a repo pattern and becomes a company problem.

Buying seats is not the same as redesigning work

The easiest way to misunderstand AI transformation is to measure adoption by access rather than by whether work is routed differently. A company can purchase licenses, encourage experimentation, and still remain structurally unchanged: individuals become a little faster, but decisions, approvals, and responsibility flow through the same assumptions the organization held before. Count the seats and AI looks transformative; ask whether a single approval path has changed, and it often has not. Until the operating model bends, AI is helpful but not yet formative.

The more interesting threshold is when AI use becomes sufficiently widespread that the operating model itself starts to bend. Dan Shipper, building the AI-native company Every, puts the discontinuity as a deliberate provocation: “There is a 10x difference between an organization where 90% of engineers use AI versus one where 100% do.” The last ten percent is where compounding effects appear. Once usage becomes pervasive, local shortcuts stop being the main story. Shared expectations shift. Documentation quality matters more. Examples, standards, prompts, policies, and internal tools start acting like leverage multipliers rather than optional aids.

This is where the Software Factory returns as an organizational case, not just a technical one. Earlier chapters showed a team turning a repo into an environment agents could use. Chapter 9 asks what happens after that. Someone has to own the rules. Someone has to decide which patterns become standard. Someone has to arbitrate between local experimentation and shared reliability. The workplace built for agents becomes, in effect, an institution with governance.

That is the first mark of an AI-native organization: it stops treating AI as a personal productivity trick and starts treating delegated machine work as part of how the company itself operates.

Cheaper execution shifts value toward judgment and throughput design

When output gets cheaper, not all work becomes equally valuable. This is the subtlety many simplistic productivity narratives miss: when generation is nearly free, the scarcity does not vanish but relocates — from making things to deciding which of them deserve trust. The rule that follows is easy to state and easy to forget: more output per person is not the same as more throughput, and an organization can produce far more while moving slower.

More things can be attempted. More variants can be generated. More tasks can be pushed into motion. But the organization still has to decide what matters, which options deserve review, which outputs are trustworthy, and where limited expert attention should go. The result is that judgment, architecture, and throughput design become even more important as raw execution becomes cheaper.

This creates new pressure on leadership roles. Product managers have to frame work more clearly because ambiguous goals produce more low-value output, not less. Senior engineers have to encode standards and review paths rather than merely embody them personally. Managers have to think in terms of queue health, bottlenecks, and quality systems, not only staffing plans. Internal platform teams become strategic because they decide whether speed compounds or fragments. Justin Reock, working on engineering leadership at DX, reframes the manager’s job as allocating judgment and attention, which stay scarce, rather than production capacity, which is now abundant. A useful test is which scarce resource each ritual rations: a standup that reports how much got produced rations the abundant thing; one that surfaces which decisions are unmade rations the scarce one.

The research on developer productivity helps here mainly as a caution. Local speed gains do not automatically improve system throughput. An engineer can open more pull requests and still make the organization slower if review queues clog, priorities scatter, or trust in the output declines. Nick Arcolano’s analysis at Jellyfish, built on some twenty million pull requests, shows the failure mode at scale: output volume rises and the dashboards light up green while the real constraint — whether the organization can review, integrate, and trust that output — goes unmeasured until it breaks. AI-native advantage therefore cannot be measured only by artifact volume. It has to be measured by the outcome — rework rate, the share of generated work that ships unreverted, time in the review queue — which is to say by whether the institution converts cheaper generation into more trusted completed work.

That is Chapter 4 at organizational scale. Evals were the control system for agents; review capacity becomes the control system for organizations using agents. Max Kanat-Alexander at Capital One names the consequence for the people inside it: “every software engineer becomes a code reviewer as basically their primary job.”

Broader creation works only when paths to ship stay constrained

One of the most provocative claims in this material is that people outside traditional engineering roles should increasingly be able to ship meaningful changes. Lisa Orr at Zapier states it as a deliberate provocation: “at Zapier we are empowering our support team to ship code.” That claim is directionally right. As execution becomes easier, more people can participate in creation. Support can encode recurring fixes. Product can prototype flows directly. Domain experts can shape automations without waiting for every translation layer. Organizations that refuse this broadening will leave leverage on the table.

Broader creation becomes durable only when paths to ship are constrained.

This is another place where the book’s earlier chapters should echo loudly. You cannot safely widen authorship without strengthening harnesses, specs, evals, permissions, and review. Otherwise democratized creation simply means democratized breakage. The organization becomes noisier, not more capable.

The strongest form of this argument is pro-scaffolding, not anti-democratization. More people should be able to create because the system around them makes safe creation easier. The right internal platforms give non-specialists narrow, high-leverage, well-governed ways to contribute. Templates, policy rails, staged approvals, sandboxed environments, and reusable agent workflows let broader participation coexist with stronger operational discipline.

This is where the Software Factory becomes a company pattern. The “factory” is not just a coding stack for engineers. It is the broader environment that packages institutional judgment so more people — and more agents — can work inside it safely. Its hardest job is encoding refusal. Vincent Koc at OpenClaw, describing the cleanup his team called the great refactor, puts it bluntly: “In a world where tokens are cheap, I can just say yes to absolutely everyone and merge everything in. But that’s going to turn this code base into an absolute fire dump.” When creation is free, the scarce discipline is deciding what not to ship.

Review becomes the organizational bottleneck

As generation gets cheaper, validation gets more expensive. If one person can now direct several agents, produce many more candidate artifacts, or explore a much wider possibility space before lunch, the organization’s existing review structures will break first. Pull requests pile up. Specs multiply. Drafts arrive faster than domain experts can inspect them. Managers lose visibility into what is real work versus local experimentation. The company starts drowning not in effort, but in options. Zack Proser, running parallel agents on WorkOS’s Applied AI team, states the inversion plainly: “agents are not the bottleneck now and I think that’s going to increasingly be the case, but we are.” Once you hand an agent verification criteria and the tools to meet them, it loops until it does, while the human attention that has to confirm the result “still degrades under load. It’s still the hard constraint.”

Chapter 4’s logic returns here as a design constraint, not a cross-reference. The hard question is no longer how to make more output appear. The hard question is how to decide what deserves trust without making humans inspect everything line by line — which means the useful unit of work is any rule that lets a person safely not look.

A mature AI-native organization therefore invests in layered review. Some outputs are rejected automatically. Some are checked against harnesses and evals. Some are sampled. Some are escalated because they touch high-risk paths. Some require domain sign-off because the consequences justify it. The point is not to force universal manual review but to create a review system proportionate to the risk and volume of delegated work. Because generation is cheap, a more trustworthy verdict can come from redundancy rather than a more expensive model: Aakanksha Chowdhery describes having the models “generate multiple responses and then do majority voting,” and Leonard Tang at Haize Labs has “weaker LLMs debate each other about what the stronger model is saying” to build judging systems that beat a frontier model at a fraction of the cost. The redundancy pays off only when the voters are genuinely independent, since one model sampled repeatedly cancels noise but not shared bias.

Eric Zakariasson’s software-factory framing matters here because it shows what management becomes when many workers, human and machine, are active at once. Someone needs a board that says what is in progress, what completed, what failed, and what now needs human attention. Without that roll-up layer, leaders do not manage a system. They manage a blur.

High-stakes domains make the same point even more sharply. In legal, tax, and compliance work, review was never optional. AI raises the stakes because it can create more candidate work than experts can casually supervise. So the organization either gets much better at triage, validation, and evidence surfacing, or it fails under the weight of its own increased productivity.

Alignment debt is the new invisible tax

Private agent workflows create a subtle organizational problem. They are often individually efficient and collectively incoherent. One engineer runs six agents on one interpretation of the problem. Another runs five agents on a slightly different interpretation. Product updates a draft in a private workspace. Support discovers a pattern and patches around it locally. Everyone feels faster. Then the organization discovers duplicated work, conflicting implementations, giant review queues with little context, and outputs that are technically impressive but strategically misaligned.

This is why Maggie Appleton’s framing is so important. Describing collaborative AI engineering from inside GitHub, she names the root cause precisely: “None of our current tools give teams a shared space to discuss plans, gather the right context, and work with agents as a collective.” The hidden cost is not only wasted effort. It is alignment debt.

Alignment debt accumulates when execution fans out faster than shared understanding. Work happens, artifacts multiply, but the common plan, relevant context, and review surfaces do not stay synchronized. Eventually the debt comes due as rework, confusion, or an exhausting burst of manual coordination.

What makes it distinctively AI-native: agent-amplified execution lets individuals move so quickly in private that the old informal coordination mechanisms stop keeping up.

The remedy is not to ban private leverage. It is to move alignment earlier. Shared planning, visible decomposition, clearer context packets, common review spaces, and artifact roll-ups become more important, not less, when execution is cheap. In other words, the org needs the same thing the agent needed: a better control plane.

Roles blur, but responsibility cannot

AI-native organizations do change role boundaries. Support can do more technical work. Product can produce working artifacts. Designers can prototype logic, not just screens. Engineers can spend more time on specification, review, and systems design. Domain experts can shape workflows directly. All of that is real.

But blurred creation does not mean blurred accountability.

In fact, accountability has to become sharper precisely because authorship becomes more distributed. The operative rule is simple: every path you widen for creation obligates you to name, before it opens, who owns the production path, who owns domain correctness, who owns the security boundaries, and who decides which workflows stay human-gated. Widened creation without an assigned owner is not democratization; it is an accountability gap waiting to be discovered after something ships.

This is another reason internal platforms matter so much. Good platforms do not only make work easier. They encode the transfer points between creation and accountability. They define what can be done safely by many people and what must still pass through narrower ownership structures.

The company becomes a harness for its own agents

At organizational scale, those same requirements turn into company design. An AI-native company externalizes standards, examples, specs, policies, permissions, review rules, and approved workflows so that both humans and agents can operate inside them. It packages taste into templates, governance into platforms, and institutional memory into accessible systems. It creates broader paths to create and narrower, better-governed paths to ship. It treats management not as inspection of every artifact, but as design of the environment in which good artifacts are more likely to emerge. That is what it means for the company to become a harness for its own agents.

The phrase should not be heard as dehumanizing. The point is not that the organization becomes a machine but that it becomes better at converting distributed intelligence — human and machine — into dependable throughput. It makes judgment reusable — a standard written down once is applied a thousand times without its author in the room. It makes oversight scalable — review effort tracks risk, not volume. It makes delegation legible — anyone can see who owns a path before they use it.

This is also where the High-Stakes Colleague quietly returns one last time. In expert domains, the institution does not win by replacing professionals with unrestricted systems; it wins by building workflows in which professional judgment is focused where it adds the most value. The same principle holds in software and in management. An AI-native organization does not eliminate people from the loop. It redesigns the loop so human attention lands on what is most consequential.

AI-native advantage is institutional, not merely individual

The strongest companies in an AI era will not simply be the ones with the most aggressive prompting culture or the highest number of tool seats. They will be the ones that learned how to convert cheap generation into trusted throughput.

That requires broader creation, tighter review, earlier alignment, stronger internal platforms, clearer authority boundaries, and operating models that treat delegated work as a first-class organizational material. Read that list as an audit: for each item, ask whether it exists as a written artifact someone owns or only as a habit in people’s heads — the first compounds, the second evaporates the moment that person is busy. It requires leaders to notice that speed alone is not the prize; the prize is compounding.

An AI-native organization is therefore not just a company where people use AI a lot. It is a company that reorganized itself so that machine-amplified work becomes cumulative instead of chaotic.

The technical question and the organizational question turn out to be the same: how do you build an environment in which delegated work deserves trust?

That question has a quieter twin: which parts of this answer outlast the churn of tools and interfaces?