Coding Agents as Team Infrastructure

One in eight merged pull requests across Shopify is now coauthored by an agent (Shopify River / Aquifer, Shopify Engineering, May 28, 2026). At Intercom, 93% of PRs across its two main codebases are agent-driven, at zero reverts across the pilot that proved it safe (Intercom).

The teams hitting those numbers did not find a better model or a sharper prompt. They built a better system around the model: each task runs in its own isolated, reproducible environment, every change is reviewed and tied to a named human, and the whole thing produces evidence an auditor can read.

The shared name for that system is team infrastructure. It has four parts: the environment it runs in, the workflow that moves work through it, the compliance argument that proves it holds, and the edges no platform has closed.

Build the Environment: an isolated machine per task

The environment is the foundation, and it is where the threat model lives. Five controls build it:

One environment per task. The boundary that makes parallelism, blast-radius containment, and the compliance properties possible at once.
Sandboxing. A removed capability is a control; an instruction the model can ignore is not.
Versioned images. Every task boots from a pinned, declarative recipe, so any run can be re-created on demand.
Egress control. Outbound traffic routes through a domain allowlist; the only question is whether the default ships open or closed.
Brokered credentials. Secrets move through a vault the model never touches, trust is split, and the snapshot is scrubbed before capture.

It defends against three documented threats: the lethal trifecta (private data, untrusted content, external communication), OWASP's agentic risks, and a casebook of seven real incidents (Replit's database wipe, the EchoLeak Copilot exfiltration, the nx supply-chain attack).

Manage the Work: request to merged code

A request becomes merged code through a fixed loop, and at every step accountability terminates at a named human.

Intake. A listener on Slack, Linear, GitHub, and cron routes work to environments and owners, not a separate tool.
Agent identity. Every agent runs under its own synthetic identity, so human-authored and AI-authored work stay distinguishable.
Review as a gate. The agent cannot approve, merge, or mark a PR ready; a person or verified system acts, and the action is recorded.
Human takeover. Picking up mid-task means branch, environment, conversation, and process state transfer together.
Rollout. Cohorts beat mandates for sequencing adoption.

Brex sets the floor, that agent work "needs to be attributed back to an actual human and not just a bot" (Brex). Intercom sets the ceiling, that "the human who ships the code remains accountable for the outcome" (Intercom).

Prove It Holds: compliance is architecture, not paperwork

Move agents off the laptop into shared cloud environments and every question the laptop silently answered reopens: whose identity is on the commit, what the agent could reach, where the code ran, who approved the change.

Seven properties. Attribution, audit trail, least privilege, isolation and residency, segregation of duties, reproducibility, and dependency provenance: what the architecture has to carry.
Evidence as a byproduct. The same resume log a crashed agent reads is the audit trail, so no one prepares for the audit.
Framework mapping. One set of properties answers SOC 2, ISO 42001, AIUC-1, and the rest in their own vocabularies.

The Landscape: how the industry runs agents

Everything companies publish fits five operating models, and every one ends the same way: a pull request reviewed under existing branch protections, merged by a human.

Five operating models. Classified by where the agent executes and who owns orchestration; all five converge on the human merge.
Eight case studies. Shopify, Stripe, Ramp, Spotify, Uber, Intercom, Brex, and Wallfacer, each derived independently and landed on the same shape.
The numbers. 90% adoption, 19% slower, 0.53% revert rates: the published evidence, including where it contradicts itself.

Start here if agents are new

The thesis. Automate the loop, not the keystroke. The argument start to finish.
Why the laptop model breaks. The case for moving agents off individual machines.
The requirements. The four properties that separate a few engineers using AI from half a team shipping through it, plus the fifth the cloud forces: compliance.
Build, assemble, or buy. The one decision that frames the rest.

Start here for a specific problem

The reader is rarely a "compliance person." More often it is someone handed a job (who reads this handbook routes each starting point):

A rollout to plan. Cohorts beat mandates for sequencing it, and build, assemble, or buy for the procurement decision underneath.
An agent PR nobody can merge. Branch protection does not model a synthetic author. See when the merge gate rejects the bot and binding the work to the human.
An auditor's questions. The 22 auditor questions, the compliance checklist, and the framework mapping.
A mandate you are the subject of. What is logged about you covers what the audit trail records, what it does not, and how attribution protects the engineer rather than surveils them.
A security review to clear. The security questionnaire prep sheet, which doubles as the checklist a founder hands a customer's CISO.

The edges no platform has closed

None of the eight cases covers every compliance property. Package installs go ungated, and the gap has teeth: 19.7% of the packages models recommend do not exist, so an attacker can pre-register the names a model reliably invents. Human takeover loses state across most vendors, and attribution stays tied to an account instead of a person. The platform comparison matrix grades every vendor, including this guide's sponsor, on the published evidence and shows the blank cells.

Wallfacer Technologies funds this handbook and appears as one case study and one matrix row among eight, graded by the same published-only rule as the rest, with its gaps disclosed where they fall. Corrections: [email protected].