Build, Assemble, or Buy: Choosing How to Stand Up Agent Infrastructure

Standing up coding agents as shared team infrastructure is a make-or-buy decision before it is an architecture decision, and the choice turns on three things: whether you have the engineers, whether agent infrastructure is core to your business, and how much of the compliance case you can afford to write yourself. The five operating models the industry actually runs reduce to three procurement paths.

• BUILD the platform in-house, the way Shopify, Stripe, Uber, and Spotify each did.
• ASSEMBLE it from open components and managed sandboxes.
• BUY a managed platform and operate on top of it.

All three are real options because the market is large enough: Gartner sizes it at roughly $9.8-11.0B annualized and in its May 20, 2026 Magic Quadrant renamed the category from "AI Code Assistants" to "Enterprise AI Coding Agents," moving the evaluation axis from suggestion quality to orchestration and governance.

Disclosure: Wallfacer Technologies funds this handbook. Wallfacer is one option on the buy path, graded below only on what it has published, alongside other real options on every path.

The platform you run on is the amplifier. The 2025 DORA report found that when internal platform quality is high, AI adoption has a strong positive effect on organizational performance, and when platform quality is low, the effect is negligible. "AI acts as an amplifier. It magnifies existing organizational strengths and weaknesses rather than being a universal solution" (DORA 2025, via Faros.ai). Whichever path you pick, you are buying or building a platform, not a feature.

Build: the proven shape, and the staffing bill

The clearest published build is Shopify's Aquifer, "Shopify's internal platform for running AI agents," with the Slack-native River agent riding on top of it: 1 in 8 merged PRs across the company are now coauthored by River. The substrate is the durable contribution: an append-only Postgres event log as "the canonical truth about what's happened so far," a harness that "lives outside the sandbox" so "the agent loop is not in the same blast radius as rm -rf," and "one reproducible substrate" built with Nix for dev, CI, and production. The authors say it plainly: "River is one profile. Aquifer is the platform."

The independence of the other builds is the strongest evidence the shape is right.

• Stripe's Minions. Merge 1,300+ PRs per week, each running in a pre-warmed devbox "isolated from production resources and the internet."
• Uber's uReview. Analyzes over 90% of the company's ~65,000 weekly diffs and saves roughly 1,500 developer hours a week.
• Spotify's Honk. Reached roughly 1,000 merged PRs every 10 days inside Spotify's existing fleet-management system.
• Ramp's Inspect. Produces about 30% of merged PRs with no mandate.

Stripe, Spotify, Uber, and Ramp built independently and arrived at the same operating pattern: cloud execution, the engineers' own toolchain inside the sandbox, closed feedback loops, and a human gate. You should not rediscover that shape from scratch.

The tradeoffs cut as you would expect.

Control and fit are total. Stripe built its own harness because "vibe coding a prototype from scratch is fundamentally different from contributing code to Stripe's codebase," with its Sorbet-typed Ruby and "vast number of homegrown libraries"; Uber built uReview rather than buy partly because "most third-party AI code-review tools require code to be hosted on GitHub" and Uber runs Phabricator. A bespoke toolchain or an unusual SCM can be reason enough to build.

Compliance is yours, and unwritten by default. None of the in-house builders documents its attribution or audit-retention mechanics, and only Ramp documents a segregation-of-duties control: open the PR with the requester's own token, never the app's, so no user can approve their own change. Building means you also build the half of the work those teams left unpublished.

The cost that gets understated is standing staff, not the prototype. Brex's first version was "three Python scripts" closing the feedback loop; the hard part scaled into orchestration, and Brex now runs its internal agent platform with 25 people out of a 350-person engineering, product, and design org (First Round Review, September 25, 2025). That is roughly 7% of the org carried indefinitely to keep the platform good, and DORA's amplifier finding says a platform that is not kept good is barely worth running. Build when agent infrastructure is core to your business and you can fund that team for years, not when you can fund a quarter.

Assemble: open parts, skip the substrate, own the seams

Assembling sits between build and buy: you take the architecture the in-house teams converged on, get its hard parts as off-the-shelf components, and write the integration and governance yourself. The convergent pattern is now open source. LangChain's Open SWE "captures the architecture that Stripe, Coinbase, and Ramp built independently," shipping isolated cloud sandboxes, curated toolsets, and workflow integration as a framework on LangGraph.

The isolated-sandbox layer underneath is a commodity you can rent.

• Modal. Ramp runs Inspect on Modal's sandboxes ("It would have been really hard to build Inspect without Modal," says Ramp's head of applied AI, Rahul Sengottuvelu).
• Fly.io's Sprites. Hardware-isolated sandbox VMs that "start in under a second."
• Kubernetes Agent Sandbox. A vendor-neutral Sandbox CRD (SIG Apps, March 20, 2026) with gVisor or Kata isolation and a warm pool to kill cold starts.
• Codex SDK. Instacart's Olive runs on it as another assembly route.

Time-to-value is faster than build, lock-in is moderate. You inherit a proven architecture and a community-maintained sandbox layer, and the parts are swappable: a different sandbox provider, a different agent SDK, the same orchestration.

Maintenance is lighter than build but not light. You still own the seams between sandbox, harness, credential proxy, and your SCM, plus upgrades when any component moves. The security spine is buildable on open primitives if you go this way: Anthropic open-sourced its sandbox runtime, and credential-proxy patterns are open source, so the brain/hands split and a deny-by-default egress proxy do not require a vendor (Anthropic, October 2025).

The catch is the same as build's, scaled down but not gone: the compliance layer is still yours to write. A managed sandbox documents isolation; it does not document your attribution chain, your audit query interface, or your segregation-of-duties enforcement. Those are properties of how you wire the parts together, which means they exist only if you build and document them. Assemble when you have a small platform capability and a near-term need, want the proven shape without a multi-year build, and can accept owning the integration and the governance.

Buy: configuration over construction, three flavors

Buying a managed platform trades construction for configuration: the vendor runs the substrate, you set policy, gates, and the evidence you collect. It is the fastest path to a running system and the one where lock-in and the limits of the vendor's published controls become your constraints. The buy market splits into three flavors with very different compliance ceilings (full grading in the matrix).

Repo-native. The most complete published compliance story, in the narrowest perimeter. GitHub's Copilot coding agent runs each task in an ephemeral GitHub Actions environment, pushes only to copilot/* branches, co-authors commits with the requesting human, cannot approve or merge its own PRs, and blocks the requester from approving them, all enforced by the platform. It is the only buy option that documents both attribution and segregation of duties as enforced behavior. The ceiling is structural: governance reaches only as far as the repo platform, so Slack-originated work, internal services, and fleet orchestration sit outside it.

Vendor sandboxes. The category with the most momentum and the weakest published attribution. Codex reached 4M weekly developers by April 2026; Devin reports a 67% merge rate across hundreds of thousands of merged PRs; Google Jules runs one isolated VM per task. Per-task isolation is the category's best-documented property, and it is real. But which identity commits, and how it binds to a requesting human, is undocumented for Codex and Jules, and segregation of duties is whatever branch protection you already had. Residency is answered only by the certification-led vendors: Augment holds ISO 42001, and Windsurf documents FedRAMP High and air-gapped deployment.

Managed substrate. The newest flavor and the one whose architecture can satisfy six of the seven compliance properties by construction: an external session log, per-task VMs, credential isolation, and execution placeable in your perimeter. Anthropic's managed-agents architecture supplies the reference design, decoupling "the brain" from "the hands" and holding tokens in a vault so "the harness is never made aware of any credentials" (Anthropic); Google announced a Managed Agents API at I/O 2026; Wallfacer (the handbook's funder, disclosed above) is a managed-platform entry in this category. It is also the least proven flavor: no managed-substrate vendor has published numbers near Stripe's 1,300 PRs per week, and the comparison matrix grades Wallfacer's own published-documentation row as almost entirely undocumented, because the architecture in its case study reached this handbook through the sponsor relationship rather than public security docs. Under the matrix's rule, a control you cannot cite to an auditor does not count, and that rule applies to the sponsor first.

The seventh property, dependency provenance, is unmet across all three buy flavors and across build and assemble too. No platform in this handbook gates package installs against a trusted source before install; Copilot's advisory-database check is the lone documented gate, and it catches only known-bad packages. Whichever path you pick, that control is yours to add.

Decide by staffing, core focus, and audit deadline

The hybrid is common: an industry survey estimates roughly 57% of organizations buy the foundational layer and build the orchestration on top (ServicesGround, 2026; single-vendor analyst estimate, treat the figure as directional). Pure positions still help you decide.

• Build when agent infrastructure is core to your business, you have a platform team you can fund for years, and a hard constraint rules out everything else: a bespoke toolchain or libraries no vendor's model knows (Stripe), an SCM the vendors do not support (Uber), or fleet-scale orchestration of your own (Spotify, Shopify). The Brex number is the reality check: budget standing staff on the order of Brex's 25-of-350, not a launch sprint, and remember DORA's finding that an under-resourced platform amplifies nothing.
• Assemble when you have a smaller platform capability and a near-term need, want the convergent architecture without the multi-year build, and can own the integration and write the compliance layer. Renting the sandbox (Modal, Fly, Kubernetes Agent Sandbox) and adopting the open framework (Open SWE) buys you the substrate and leaves you the seams.
• Buy when you lack the engineers to build well, agent infrastructure is not your differentiator, or the audit has a date on it. Then pick by ceiling: repo-native if your work lives entirely in the repo platform and you want the strongest enforced gates today; a vendor sandbox if you need throughput now and can accept convention-grade attribution; managed substrate if you need the architecture that an audit can be built on and can accept that public scale is not yet proven.

Regulatory exposure cuts across all three and can override team size. A regulated team that needs data residency, per-human AI identity, or an auditor-facing query interface may find that no buy option documents those properties yet, and that the control it needs is one it must own, by building or assembling. A team with the engineers and a core need may rightly build, and a regulated team may need control no managed platform can currently give. Run the seven properties as a documentation request against any candidate, and treat "we do that but have not written it down" as a no until the writing arrives.

If you build or assemble, Build the Environment is the spec for the substrate (sandboxing, images, placement, the perimeter, and the threats that motivate them) and Manage the Work is the spec for the workflow on top (intake, identity, review gates, takeover, rollout). If you buy, those two acts become a questionnaire, because a control you cannot point a vendor's docs at is a control you cannot put in an audit. Prove It Holds turns the seven properties into the audit argument, The Landscape carries the evidence and case studies behind every number on this page, and Reference holds the per-vendor detail, graded on published documentation only.