The Four Requirements for Team-Scale Agents, Plus the Fifth the Cloud Forces

Intercom merges 19% of its pull requests with no human in the loop, at zero reverts across the pilot that proved it safe. The distance between that and "a few of our engineers use Copilot" is not a better model or a sharper prompt. It is four properties of the system around the model, and most teams have zero of them:

1. An environment that outlives any laptop. Reproducible on demand, identical for the tenth task and the ten-thousandth, owned by no one's machine.
2. A written definition of "done." The criteria a change must meet to merge, encoded so an agent can follow them and an auditor can verify them.
3. An explicit owner on every step. Every action, agent or human, runs under a named accountable actor that is recorded and queryable.
4. Human takeover without reconstruction. A person can step into the work mid-task and find the same branch, environment, conversation, and process state, with nothing to rebuild.

Each is something you build into the system, not a habit you ask engineers to keep, and each is stated below as a testable property with the mechanism that satisfies it. The first three are demonstrated in production by published teams. The fourth has supporting evidence and a working primitive, but no shipping product transfers all four pieces of state at once. Move all four off the laptop and into the cloud and a fifth requirement opens that the laptop model never had to answer: compliance.

These four are the operating requirements, distinct from and a precondition for the seven properties the compliance act is built around (attribution, audit trail, least privilege, isolation and residency, segregation of duties, reproducibility, dependency provenance). The four make the work happen; the seven make it provable.

Requirement 1: an environment owned by no laptop

The test. Provision a task's environment from scratch and the tenth run and the ten-thousandth are identical, and no property you care about depends on a specific machine surviving.

When Anthropic decoupled the agent's reasoning loop from the container its code runs in, p50 time-to-first-token dropped roughly 60% and p95 dropped over 90% (Anthropic, Scaling Managed Agents). The latency is a symptom of the real change: the environment became cattle, not a pet. A failed sandbox is re-provisioned; a failed harness reboots with wake(sessionId) and replays the event log. Nothing depends on any one machine surviving, which means nothing depends on any one human's machine existing.

The mechanism. A per-task environment built from a versioned image, carrying the real toolchain, provisioned by the platform rather than assembled by hand. When the environment is a laptop, every property you care about (access, isolation, reproducibility) is an accident of whoever owns the machine. Brex made the same move at the operating level: each task gets its own Remote Developer Environment carrying the same toolchain its engineers use, which is what let it run a gRPC migration across 400+ services with agents iterating in parallel. Brex's verdict on running 50 agents at once: "Parallelization is a systems design problem."

The environment is also the lever that decides whether the model helps at all. DORA's 2025 report, drawing on nearly 5,000 technology professionals, finds "a direct correlation between a high quality internal platform and an organization's ability to unlock the value of AI," and frames the model as an amplifier: "AI doesn't fix a team; it amplifies what's already there" (2025 DORA Report). A weak environment gets its weaknesses magnified.

Built in Build the Environment, starting at one environment per task, with versioned images as the reproducibility primitive.

Requirement 2: a written definition of "done"

The test. The same write, review, approve, ship sequence runs for every task, the criteria are explicit (including the refusals), and a third party can read the criteria without asking anyone what they were.

The Intercom numbers above are impossible with a process that lives in engineers' heads. An agent cannot follow an unwritten convention, and an auditor cannot verify one. Encoded, the process becomes the change-management policy itself: the criteria are the same for every task, and the gate enforces them rather than relying on reviewer discipline.

The mechanism. A change-management process expressed as something the system runs, not something people remember. Intercom's review agent "won't approve large PRs"; it flags them and demands a break-down, which turns scope discipline from a style preference into an enforced gate. The same encoded definition of done is what lets the gate be automated without weakening the control, and it is exactly the artifact SOC 2's change-management criterion (CC8.1) expects to see, generated by the system rather than reconstructed for the audit (see segregation of duties).

Built in Manage the Work, starting at work intake and scoping, with the gate itself specified in review as a gate.

Requirement 3: an explicit owner on every step, human or agent

The test. For any action in the history (plan, write, review, ship), you can name the accountable actor, and the author of a change and its approver are provably different actors.

Brex states the floor in one line: agent work "needs to be attributed back to an actual human and not just a bot." Intercom states the ceiling: "The engineer who ships a change is expected to watch it go live, monitor its behaviour in production, and be ready to roll back." When an agent plans, writes, reviews, or ships, someone is accountable, and that ownership is explicit, recorded, and queryable. An AI step that writes code and a human step that approves a deploy are both first-class.

The mechanism. A distinct identity per agent, bound to the human who initiated the work, never a borrowed human token. This is what makes segregation of duties possible at all: you cannot prove the author and the approver were different actors if every action ran under one shared credential. Practitioners name the failure mode directly. On how security teams approach identity for AI agents, one notes that with agents on "shared service accounts or individual API keys, but there's no consistent way to identify which agent performed which action, control what each agent can access, [or audit]" (r/cybersecurity, u/SarveshRD, score 8, March 17, 2026; community sentiment, not fact). The owner model is the requirement that closes that gap.

Built in Manage the Work, starting at a distinct identity per agent and binding the work to a human. The proof side, attribution, is one of the seven compliance properties.

Requirement 4: human takeover that transfers all state

The test. When a person steps in mid-task, it is indistinguishable from another human picking up the work: same branch, same environment, same conversation, same process state. No "let me reconstruct what the bot was doing."

This is the requirement the industry has not met. A survey of ten shipping platforms found that every vendor ships a takeover feature and none transfers all four things at once. Claude Code's teleport "fetches and checks out the branch from the cloud session, and loads the full conversation history into your terminal," but lands you in your local environment, not the agent's. Devin and Factory hand you the agent's machine but keep the work inside their walls. The vocabulary is fragmented too: "teleport," "handoff," "pairing mode," "take over," with no shared definition of what a complete handoff transfers.

The mechanism. State that lives outside any one actor's machine: the branch in the remote, the environment in the platform, the conversation and process state in an external session log, so a human attaches to the same primitives the agent used. The payoff is measurable where it has been studied: Alibaba's AgentBay sandbox, which lets a human "at any moment, seamlessly take over full manual control," reports a relative success-rate improvement of more than 48% for agent-plus-human over agent-only. The failure mode when state does not transfer is the passive watcher: as one practitioner puts it, "if your humans are only engaging post-error, you've designed a monitoring role without giving them monitoring affordances" (r/AI_Agents, u/Specialist_Golf8133, score 1, June 1, 2026; community sentiment, not fact). Takeover also quietly forces the other three: it is seamless only if the environment, process, and history already live outside any one actor's machine.

The bar is the four-transfer standard in Manage the Work.

The fifth requirement the cloud forces: compliance

Doing all four in the cloud reopens every compliance question the laptop silently answered: whose identity is on the commit, what the agent could reach, where the code ran, who approved the change. Intercom is the only one of the three that engaged its auditors (Schellman) and named its frameworks: SOC 2, HIPAA, ISO 27001, ISO 42001, AIUC-1. The rest of the field is silent. That silence is why the laptop never had to answer this, and Prove It Holds works through the questions it leaves open, turning the four operating requirements into the seven properties an auditor can read: attribution, audit trail, least privilege, isolation and residency, segregation of duties, reproducibility, dependency provenance.