The Thesis: A Systems Problem, Not a Model Problem

The teams shipping the most code through agents are not running a better model than you are. Brex says so directly: "The gap between 'AI agents can do this' and 'AI agents are doing this reliably' is mostly an infrastructure problem." The model is roughly the same one you can call from your own terminal. What separates Intercom auto-approving 19% of its pull requests at zero reverts from a team where two engineers use Copilot on their laptops is the environment the agents run in, the gates the work passes through, the identity on each commit, and the record an auditor can read later. None of that is a prompt.

The published results come from infrastructure, not prompting

Every report of agents past autocomplete attributes the result to the system, not the model. The evidence is already on the record.

• Brex closed a feedback loop. It migrated gRPC client factories across 400+ services by giving each agent its own remote developer environment and wiring CI failures, review-bot comments, and test results back to it automatically. The breakthrough was not a smarter agent. It was reaching information "sitting in systems they can't reach." Before the loop closed, engineers spent afternoons copying CI output into chat, "an expensive solution to a plumbing problem."
• Intercom built a review system. Over 19% of its pull requests auto-approve with no human reviewer. The PR-review agent decomposes review into independent sub-agents, traces execution paths, refuses to approve large PRs, and labels and logs every decision so "the evidence an auditor expects to see is the same whether a human or an AI approved the change."
• Anthropic changed the architecture. It rebuilt its hosted agent service and dropped p95 time-to-first-token over 90% and p50 roughly 60%, with no change to the model. Stateless harnesses now attach to sandboxes only when a task needs one, so a session no longer waits on a container it may never touch.

Three companies, three different wins, one shared cause: infrastructure, process, and review. These are the three reports the rest of the Overview reads in full before the later acts build on them.

The structural move is decoupling the brain from the hands

The single most repeated architectural decision in the published record is keeping the brain out of the sandbox where the code runs. Anthropic titled its writeup "Scaling Managed Agents: Decoupling the Brain from the Hands." The brain is the agent loop, the harness that calls the model and routes its tool calls. The hands are the sandbox where code actually runs: the filesystem, the shell, the repo checkout. The brain does not live where the code lives.

The split fixes two failures at once. Anthropic started with everything in one container, the session, the harness, and the sandbox all sharing an environment, and hit an old infrastructure problem: "we'd adopted a pet." When the container failed, the session was lost. Worse, untrusted code the model generated ran in the same container as the credentials, so a prompt injection only had to convince the model to read its own environment.

Credentials move where the sandbox cannot reach. Git tokens are wired into the local remote during sandbox setup so push and pull work without the agent ever handling the token; custom-tool credentials sit in a vault that a proxy reads on the agent's behalf. "The harness is never made aware of any credentials."

Shopify reached the same architecture independently and described the payoff in one line: "the agent loop is not in the same blast radius as rm -rf." When the brain is decoupled from the hands, a destructive command, a crashed container, or a poisoned dependency is confined to a throwaway sandbox instead of taking down the session, the credentials, and everything the agent could reach. (Shopify's River coauthors 1 in 8 merged PRs across the company, on a substrate Shopify calls Aquifer; the full case study lives in the Landscape.)

The reliability, the security, and the speed all come from where the pieces sit relative to each other, not from how the model is prompted. Build the Environment takes this split as its starting point and works outward to sandboxing, egress control, and credential handling.

The model floor is high, so the system is where the variance lives

The model is roughly a constant across the field while the system around it is not. If a better model were the answer, the laptop would be enough: it runs the same frontier model the platform teams run.

DORA's 2025 report, drawing on nearly 5,000 technology professionals, puts it in one sentence: "AI doesn't fix a team; it amplifies what's already there" (2025 DORA Report). 90% of respondents use AI at work and more than 80% say it raised their productivity, yet AI adoption still has a negative relationship with software delivery stability. The same report names the resolving variable: "there is a direct correlation between a high quality internal platform and an organization's ability to unlock the value of AI." 90% of organizations have adopted at least one platform.

AI scales whatever system it lands in, up or down. A strong system gets a strong multiplier; a weak one gets its weaknesses magnified. That is also why "automate more" is the wrong target before the system exists. Brex's CTO James Reggio: "When you set the goal at 100% automation as opposed to 40% automation, you end up making investments that are oftentimes going to yield zero value" (First Round Review, Sep 25 2025). The system you build determines how far automation can safely go, not the other way around.

What "the system" actually is

The system the model amplifies is four things, none of which is a model or a prompt. The requirements page takes each in turn. In brief:

1. Reproducible cloud environments, not attached to any human's machine, identical for the tenth task and the ten-thousandth. Ramp's head of applied AI on why this is the hard part: "A lot of the complexity is hidden behind just being able to spin up sandboxes very quickly with a lot of services and data" (Modal, How Ramp Built Inspect, Feb 19 2026).
2. Decision gates and a written definition of done. What "ready to merge" means, what gets reviewed, what may auto-approve. Intercom's gate is its review agent; over half its codebases' PRs now pass through it.
3. Attribution. When an agent plans, writes, reviews, or ships, a specific human is accountable. Brex states the rule plainly: agent work "needs to be attributed back to an actual human and not just a bot."
4. A queryable audit trail. Every action labeled, logged, and answerable to "who did what, with what access, approved by whom." This is the property the laptop model never had to produce and the one the literature documents least.

Manage the Work builds the gates, roles, and takeover paths. Prove It Holds is where the audit trail becomes a compliance argument, because moving all four off the laptop forces a question the laptop's one-sentence governance ("the human at the keyboard is responsible") quietly answered by collapsing it.

Where to go next