Five Operating Models, One Gate Everyone Agrees On

Every company publishing about coding agents as a team practice fits five operating models, and every one ends the same way: a pull request reviewed under the customer's existing branch protections, merged by a human. Almost nothing else converges. Two questions classify the five models:

• Where does the agent execute. Laptop, repo platform's CI, vendor cloud, or your cloud.
• Who owns the orchestration. Each engineer, the repo platform, the vendor, or you.

The market behind them is large and moving. Gartner renamed its category from "AI Code Assistants" to "Enterprise AI Coding Agents" in its May 20, 2026 Magic Quadrant and sizes it at roughly $9.8–11.0B annualized. The Pragmatic Engineer's March 2026 survey of 906 engineers found 55% regularly using agents, up from near-zero 18 months earlier.

The handbook's build/assemble/buy paths map onto these: A is Path 1, D is Path 2, and B, C, and E are three flavors of Path 3 with very different compliance ceilings.

A. Laptop-first: adoption lives here, governance doesn't

Model A produces the adoption numbers and collapses every compliance property onto the human at the keyboard. Booking.com went from under 10% to 70% adoption across 3,000+ developers; Monzo reports PRs per engineer up 10–20% and names review the new bottleneck. These are enablement programs, not platforms. Attribution is the engineer's own token, the audit trail is whatever the laptop kept, and isolation is none. None of the documented rollouts publishes anything about agent identity or credential isolation, which is why this model is the starting line and not the destination.

B. Repo-native CI: the most complete published compliance story

GitHub's Copilot coding agent is the only widely deployed system whose vendor documents attribution and segregation of duties as enforced platform behavior. Per GitHub's docs, the agent runs in an ephemeral Actions container, pushes only to copilot/* branches, co-authors commits with the requesting human, cannot approve or merge its own PRs, and blocks the requester from approving them.

The ceiling is structural: governance reaches only as far as the repo platform. Work entering from Slack or a ticket system, environments needing internal services, and fleet-scale orchestration sit outside the model. GitHub's own docs note the agent does not honor content exclusions, so files an administrator configured Copilot to ignore remain visible to it, and the docs are silent on residency and an auditor-grade query interface.

C. Vendor cloud sandboxes: the momentum, attribution the weak spot

This is the fastest-growing category in 2026 by every published number. OpenAI Codex reached 4M weekly developers by April 2026 (secondary, citing OpenAI); Devin reports a 67% merge rate across hundreds of thousands of merged PRs, and Goldman Sachs piloted hundreds of instances. Per-task isolation is the category's selling point and best-documented property. Attribution is its weakest: which identity commits, and how it binds to a requesting human, is undocumented for Codex and Jules. Segregation of duties is convention, enforced only by whatever branch protection the customer already has. Augment (ISO/IEC 42001, SOC 2 Type II) and Windsurf (FedRAMP High, air-gapped) lead a certification race that answers residency as a deployment option, not per-task placement.

D. In-house platforms: five companies, one architecture

Stripe, Ramp, Spotify, Uber, and Shopify built in-house systems around the same pressure points, which is strong evidence the shape is right: cloud execution, the engineers' real context and toolchain, closed feedback loops, and a human gate.

• Stripe Minions. 1,300+ PRs per week from Devbox sandboxes.
• Ramp Inspect. ~30% of merged PRs with no mandate.
• Spotify Honk. Roughly 1,000 merged PRs every 10 days.
• Uber uReview. Runs at CI scale; comments addressed more often than human reviewers' comments.
• Shopify River. Coauthors 1 in 8 merged PRs, on Aquifer, an in-house substrate that independently rebuilt the brain/hands/durable-session design.

LangChain open-sourced the coding-agent version of the convergent design as Open SWE. These teams publish the most about isolation and feedback loops and the least about everything compliance-shaped: none documents a complete agent identity model or audit retention policy, and only Ramp documents a clear segregation-of-duties mechanism (PRs open with the requesting user's token, so nobody approves their own change). See the in-house convergence for the full pattern.

E. Managed substrate: the right shape, not yet proven at scale

Model E exists because D's architecture is now known and nobody wants to rebuild it. Anthropic's managed-agents article supplies the reference design; Google announced a Managed Agents API at I/O 2026; Open SWE is the self-hosted version; Wallfacer is the managed-platform entry.

This is the only category whose architecture makes the first six compliance properties possible by construction: external session log, per-task VMs, credential isolation, VPC-placeable hands. The seventh, dependency provenance, is a separate install-path gate that no vendor documents today.

Model E is also the least proven in public. No E vendor has published customer-scale numbers comparable to Stripe's 1,300 PRs/week or Codex's 4M weekly developers.

Movement runs one direction, toward the compliance gap

Teams move A to C for individual throughput, A to D when they can staff the platform, and D builders increasingly assemble on vendor primitives rather than from scratch: Instacart's Olive is built on the Codex SDK, Ramp runs on Modal's sandboxes.

The compliance half is what none of them converges on, and most don't publish at all: attribution mechanics, audit query interfaces, residency, segregation of duties. That gap is why the laptop never had to answer this, and the rest of this section measures each model against it: the honest numbers, what the incidents teach, and the seven case studies.