In the 23 days since 1 July, the software estate I run has taken around 440 commits across twelve repositories. Seven of those repositories did not exist when the month started. Across more than seventy working sessions, five complete products or public websites went live — a Marbella property business’s site rescued from Squarespace, my father’s trade firm’s site rebuilt from Wix, a quarterly tax tool for Spain’s self-employed, a free public mortgage calculator, and the live demo of a client fact-find platform for financial advisers — with three product marketing sites alongside.

I am one person. I do not have a development team. The building was done by AI agents, working inside a system I have spent this year assembling. This post is about the system, because the system — not the speed — is the interesting part. And because the same discipline that runs it is exactly what I install inside client firms.

What shipped, concretely

A quick tour, so the numbers aren’t abstract:

  • A secure client fact-find platform for financial advisers went from written specification to a live multi-organisation demo: encrypted at rest, GDPR erasure and export built in, a client portal with magic-link sign-in, cashflow modelling, and auto-filled Word documents.
  • An agent-run editorial desk gained an in-portal editor and an image pipeline with hard compliance gates, and now produces reviewed content for four organisations — articles, newsletters, social posts, even property listings pulled automatically from a listings feed.
  • A tax admin tool for Spain’s autónomos went from first commit to a live, encrypted product with legal pages in English and Spanish, multi-currency support, and regional tax tables for all fifteen state-system regions.
  • Two complete public websites went live with working contact forms, structured data, and automated SEO reporting.
  • An introducer portal demo was built almost entirely autonomously: an agent worked from a written spec and a set of golden test fixtures until every test was green, then deployed the result.

None of that is the point. The point is how.

The six habits that make it a factory

Specifications are the contract. Every tool has a spec that wins over code — if they disagree, the code is wrong. That is what makes autonomous building safe: the introducer portal above wasn’t “vibe coded”, it was built against fixtures that defined correct behaviour before a line was written. The agent’s job was to make reality match the document.

Shared services, not copies. One service collects feedback and enquiries from every tool and site in the estate. One monitoring service health-checks every live system each minute and alerts within sixty seconds of a sustained problem. One monthly report covers search performance and indexing for every site. When something new launches, it plugs into all three. Nothing gets rebuilt, so every launch makes the next one cheaper.

Patterns get stamped, not reinvented. The same application stack underpins four of the tools. A marketing-site pattern — own repository, static build, no cookies, enquiry form into the shared leads service, properly researched legal pages — shipped three times in three days for three different products. A lead-capture gate built for one public demo was reused for two more within a week. Once a pattern is proven, its next use costs almost nothing.

The plumbing is zero-touch. By mid-July, an agent could take a new domain from registrar to fully live — DNS, TLS, search-console verification at both Google and Bing, sitemap submission, analytics — entirely through APIs, with no dashboard clicking. That chain has now run end to end for three domains.

Every defect becomes an automated check. This is the rule I formalised in writing on 17 July, after a page shipped unstyled because of a wrong assumption about how styles were scoped. The fix took minutes; the important part was what followed: a written root cause, and a build-time gate that now scans every page for the same class of mistake. Six days later the incident log has twelve entries, and each one follows the same shape — fix, root cause in writing, automated check that would have caught it. The standing rule: the same class of defect must not be findable by a human twice. This is the ratchet that lets output scale without quality decaying.

Humans hold the approval gates. Agents draft; people approve. Editorial content passes a compliance check before publishing. AI-generated images require a human save before they can go anywhere near a page. My father’s site runs under a copy-honesty rule — no invented claims, no fake reviews, only facts the owner confirmed. And every product roadmap carries a list of items only I can sign off, which agents may add to but never remove. The factory moves fast precisely because the judgment points are fixed and explicit, not despite it.

What this means if you’re not a software company

Here is the part that matters if you run an advice firm, a brokerage, or any process-heavy regulated business: the factory is not a trick for building websites quickly. It is an operating model, and its parts map one-to-one onto your operations.

Systems talking to each other by API instead of staff re-keying between them — that is your CRM, your back office, and your document production. Agents doing the repetitive middle — drafting, categorising, reconciling, filling — with the source and confidence recorded for every value, so a person reviews the uncertain cases instead of all of them. Humans at defined approval gates with an audit trail, which is the structure your compliance team already asks for. Defects converting into controls, which is what a good breach register should do and mostly doesn’t. Monitoring that tells you something broke before a client does.

And the pieces compound when they’re connected. A fact-find that auto-fills the suitability report. An editorial desk that publishes to your website and social channels only after a compliance pass. A form-filling service that shows its evidence per field and routes only the doubtful answers to a person. Each of those exists today — you can inspect them on the Labs page — and together they start to look like the operations layer of a modern firm.

The honest caveats

Agents get things wrong. That is not a footnote; it is the design assumption. The incident log exists because defects happen, and the governance came first — specifications, approval gates, monitoring, and the ratchet were in place before the output scaled up, not bolted on after. If you are putting agents to work in a regulated business, that ordering is the whole game, and I’ve written separately about what that governance framework looks like.

The other caveat: the steering is the skilled part. Knowing what to build, what “done” means, which defects matter, and where the approval gates belong came from ten years of running operations in financial services — not from the tools. The agents supply the hands. The operating discipline still has to come from somewhere.

That discipline is the thing I actually sell. If you want it pointed at your firm’s operations rather than my estate, that conversation is free.