Module 5: Govern the Factory and Bring the Team Along

Secure the factory before you scale it

A factory puts an autonomous agent on your golden paths. That agent holds credentials, runs around the clock, varies more than a human does and has no instinct for when something feels wrong. Autonomous agents raise your exposure to credential leaks, runaway cost and unwanted side effects, warns TrueFoundry's team.

Build the utilities layer under the agents

A software factory is only as good as its utilities, the layer beneath the agents and the pipeline:

Shared infrastructure can cover some of these controls for the whole factory. Repository, CI, sandbox and evaluator controls may stay local to each delivery system.

Give every agent an identity and scoped access

Your basic factory already decides who each agent acts as and what it can access. Now manage those credentials centrally, and inject them at runtime. Never embed them in agent definitions.

Enforce controls where the agent can't bypass them

Controls are strongest when you enforce them at mediated boundaries the agent cannot get around. Unmanaged paths and downstream systems still need their own protection.

Map every path an agent can act through:

The harness sandbox covers only the harness's own shell tool. Tools from MCP servers sit outside that sandbox, so they must enforce their own guardrails.

Set budgets in one of two modes. An enforced rule blocks further LLM requests once a limit is exceeded. A warn-only rule gives you visibility without a block.

Answer the inspector's question

Ask what happens in the system's worst hour:

1. Which operations are mediated?
2. Which identities and permissions apply?
3. Which limits are enforced?
4. What evidence survives?
5. Where must a human authorize before work continues?

A credible answer spans the agent runtime, the model and tool gateways, and sandbox and network controls. It also covers source control and CI policy, plus the downstream systems agents can change. Scale your controls to what the factory can access and change.

Roll out the factory and keep your team's trust

A factory changes an engineer's day: work becomes public and measured, and the job splits in two. Roll it out with that in mind, advises Zach Lloyd, founder and CEO of Warp.

Keep a human accountable at every gate

Agents do the work, and people own the outcome. Dropbox defines the task, lets the agent execute within guardrails and validates the result. A human then makes the final judgment before any code reaches production.

Name what will feel hard

Be open with your team about four sources of discomfort:

• Work goes public. In a factory, all work is public by default, including work that used to stay private in a developer's inner loop. That exposes how you work, not just what you build.
• Work gets measured. It's easy to see how efficient each engineer is in token use. That can make people feel like cogs in a machine.
• The metaphors sting. "Factory" suggests an assembly line, or the build of a line that makes your talent obsolete. "AI teammate" suggests a manager of sycophantic, somewhat inept junior engineers. For people proud of their craft, both feel like commoditization.
• Talk of dark factories demotivates. If humans aren't needed, engineers rightly ask what their job is. Business leaders may want dark factories, which run with no human oversight, but they are not realistic right now. Chasing them demotivates the team and can cause attrition.

Make factory work part of the job

At Warp, engineers have two explicit jobs: build the product, and improve the factory that builds it. Both jobs belong to every engineer, so factory engineering reads as part of software engineering. Make that real:

• Build factory work into feedback and performance reviews.
• Celebrate changes that make code production more efficient or higher quality.
• Ask senior engineers to model the behavior.

Treat visibility and measurement as a feature, not a bug. Push the whole team to work more in public, with a bias toward automation.

Frame it as real engineering

Factory engineering is engineering, of a new kind, and it can be fun. The people who like it most are senior engineers who love hard systems problems and enjoy optimizing and debugging performance issues.

It takes a lot of thought, testing and patience. Lean into it as a new skill to learn, one that lets your team ship better products more quickly.