The Three Reports: Architecture, Infrastructure, and the Review Gate

Three teams published how they run coding agents in production. Each one nails down a different layer the rest of this guide builds on, and each backs it with a real production number, not a benchmark or a demo.

• Anthropic proves the architecture. Split the agent into a stateless brain, replaceable hands, and a durable session log, and p50 time-to-first-token drops roughly 60% while p95 drops over 90%.
• Brex proves it is an infrastructure problem, not a model problem. Agents stall when cut off from CI, review bots, and tests, not when the model is weak. Proven across a migration of 400+ services.
• Intercom proves the review gate. A strict, instrumented AI reviewer auto-approved 19% of pull requests with no human in the loop, at zero reverts in the pilot, and an auditor signed off.

Why these three, not the bigger headline numbers

The selection is not "the three best blog posts." It is the smallest set that covers the three layers a team-grade system needs (run the agent off a laptop, close the loops, gate the merge), where each layer has a first-party operations report behind it, not a benchmark or a demo. Each report names a real production number, states the mechanism that produced it, and reports a lesson the team learned the expensive way.

The famous case studies sit downstream of these three, not beside them. Stripe's Minions, Ramp's Inspect, and Spotify's Honk publish bigger headline numbers, but each is one company's instance of the same three layers: an isolated environment (Anthropic), closed feedback loops (Brex), and a human-reviewed merge (Intercom). They show the pattern scales rather than being the source of it. Uber's uReview is a deep account of one layer, AI code review, but not the environment or the orchestration around it. The three reports are the ones that, stacked, describe the whole substrate, and each fences its own scope honestly enough to trust.

Anthropic proves the architecture: decoupling cut p95 over 90%

Scaling Managed Agents virtualizes an agent into three interfaces: the brain (the model plus the harness loop), the hands (a sandbox called like any tool, execute(name, input) → string), and the session (an append-only event log stored outside both). Decoupling the three turns hand-tended containers into replaceable infrastructure: a failed sandbox is re-provisioned, and a failed harness reboots with wake(sessionId) and replays the log. Because harnesses became stateless, sessions stopped paying container setup cost up front, so p50 time-to-first-token dropped roughly 60% and p95 over 90%.

The credential boundary. Credentials never reach the sandbox where model-generated code runs, either bundled into a resource at init (a Git token wired into the remote) or held in a vault behind an MCP proxy, so that "the harness is never made aware of any credentials" (Anthropic).

Harness assumptions go stale. The report names the maintenance trap: harnesses "encode assumptions about what Claude can't do," and those assumptions rot. Context resets built for Sonnet 4.5's "context anxiety" became "dead weight" on Opus 4.5.

Brex proves it is an infrastructure problem, not a model problem

Building Autonomous Agents for Technical Tasks was written around a gRPC client-factory migration across 400+ services in Brex's monorepo, and its central claim is blunt: "The gap between 'AI agents can do this' and 'AI agents are doing this reliably' is mostly an infrastructure problem" (Brex). Agents do not fail because the model is weak. They fail because CI logs, review-bot comments, and stack traces never reach them, so engineers became messengers copy-pasting automated feedback into chat. "That's an expensive solution to a plumbing problem."

The fix was infrastructure. Each task gets its own Remote Developer Environment (an isolated workspace with the same toolchain engineers use), tasks enter from Slack, Linear, GitHub, or a cron job, an orchestrator routes them to an agent pool, and the loop closes itself until a green PR is waiting for human review.

A candid build log. The MVP was three Python scripts; the hard part was "a systems design problem," meaning orchestration, isolation, and running 50 agents in parallel.

Two governance principles, stated early. Ahead of any compliance requirement, Brex commits to two: agents get only the information the task requires, and agent work "needs to be attributed back to an actual human and not just a bot." That is the earliest of the three reports to state the attribution and least-privilege case this guide builds on.

Intercom proves the review gate: 19% auto-approved, zero reverts, an auditor signed off

AI Is Approving Our Pull Requests reports that over 93% of PRs across Intercom's two main codebases are agent-driven and over 19% are auto-approved with no human in the loop. At that volume, a strict AI reviewer can be safer than a human queue drifting toward rubber-stamping. The line that earns it a place here cuts against intuition: the product changes that did cause outages in the past "were all reviewed and approved by humans. Human review is not a guarantee of safety" (Intercom).

Review decomposed into sub-agents. Independent sub-agents (problem description, intent alignment, safety, logical correctness, best practices) split the work, and the reviewer traces execution paths through the codebase, which humans "rarely had time to do." The agent refuses to approve large PRs, forcing small, reversible changes.

The data. Zero reverts in the 100-PR pilot, a 6-16x improvement in p75 time-to-approval, and AI-authored code reverting at a fraction of human rates (backend 0.53% vs 5.39%, frontend 0.22% vs 2.00%).

The only one with a compliance section. Every decision is "labelled, logged, and queryable," and Intercom engaged its auditors, Schellman, early to confirm the process meets SOC 2, HIPAA, ISO 27001, ISO 42001, and AIUC-1. Accountability stays human: the engineer who ships watches it go live and is ready to roll back.

What the three leave open is compliance for a team

Each report assumes away the layers the other two solve, and all three assume away the compliance story for a team. Anthropic describes the substrate but says nothing about attribution, segregation of duties, or what an auditor would ask; the laptop-era answer ("your machine, your token, your responsibility") is inherited silently. Brex names attribution and least privilege as principles in one paragraph and stops there. Intercom comes closest, but its scope is one gate (PR review) at one company with one auditor; it does not cover identity for the agents that write the code, credential isolation in the environments they run in, data residency, or dependency provenance.

The three are also silent on human takeover: what happens when a person needs to step into an agent's half-finished task. And across all three, data residency and where session logs may legally live go unmentioned.

Stack the three and you get the reference architecture that opens the next act, Build the Environment, where credential isolation and the threat model that motivates it live. Human takeover, identity, and the decision gates the three only gesture at are worked through in Manage the Work, starting with review as a gate and binding the agent to a human. The gap that remains is compliance, which Prove It Holds answers as an architecture argument rather than paperwork.