In the 23 days since 1 July, the software estate I run has taken around 440 commits across twelve repositories. Seven of those repositories did not exist when the month started. Across more than seventy working sessions, five complete products or public websites went live: a Marbella property business’s site rescued from Squarespace, my father’s trade firm’s site rebuilt from Wix, a quarterly tax tool for Spain’s self-employed, a free public mortgage calculator, and the live demo of a client fact-find platform for financial advisers, with three product marketing sites alongside.

I’m one person, with no development team. AI agents did the building, inside a system I’ve spent this year putting together. This post is about that system, because it’s more interesting than the speed, and because the same discipline is what I set up inside client firms.

What shipped, concretely

A quick tour, so the numbers mean something:

  • A secure client fact-find platform for financial advisers went from written specification to a live multi-organisation demo: encrypted at rest, GDPR erasure and export built in, a client portal with magic-link sign-in, cashflow modelling, and auto-filled Word documents.
  • An agent-run editorial desk gained an in-portal editor and an image pipeline with hard compliance gates, and now produces reviewed content for four organisations: articles, newsletters, social posts, even property listings pulled automatically from a listings feed.
  • A tax admin tool for Spain’s autónomos went from first commit to a live, encrypted product with legal pages in English and Spanish, multi-currency support, and regional tax tables for all fifteen state-system regions.
  • Two complete public websites went live with working contact forms, structured data, and automated SEO reporting.
  • An introducer portal demo was built almost entirely autonomously: an agent worked from a written spec and a set of golden test fixtures until every test was green, then deployed the result.

How it got built matters more than the list.

The six habits that make it a factory

Specifications are the contract. Every tool has a spec that wins over the code: if they disagree, the code is wrong. That’s what makes autonomous building safe. The introducer portal above wasn’t “vibe coded”. It was built against fixtures that defined correct behaviour before a line was written, and the agent’s job was to make the software match the document.

One shared service per job. One service collects feedback and enquiries from every tool and site in the estate. One monitoring service health-checks every live system each minute and alerts within sixty seconds of a sustained problem. One monthly report covers search performance and indexing for every site. When something new launches, it plugs into all three. Nothing gets rebuilt, so each launch makes the next one cheaper.

Proven patterns get reused. The same application stack underpins four of the tools. A marketing-site pattern (own repository, static build, no cookies, enquiry form into the shared leads service, properly researched legal pages) shipped three times in three days for three different products. A lead-capture gate built for one public demo was reused for two more within a week. Once a pattern is proven, its next use costs almost nothing.

The plumbing is zero-touch. By mid-July, an agent could take a new domain from registrar to fully live (DNS, TLS, search-console verification at both Google and Bing, sitemap submission, analytics) entirely through APIs, with no dashboard clicking. That chain has now run end to end for three domains.

Every defect becomes an automated check. I wrote this rule down on 17 July, after a page shipped unstyled because of a wrong assumption about how styles were scoped. The fix took minutes. What mattered was what came after: a written root cause, and a build-time check that now scans every page for the same kind of mistake. Every defect since has gone the same way: fix it, write down the root cause, add the automated check that would have caught it. The standing rule is that a person should never find the same kind of defect twice. That’s what lets output grow without quality slipping.

Humans hold the approval gates. Agents draft; people approve. Editorial content passes a compliance check before publishing. AI-generated images require a human save before they can go anywhere near a page. My father’s site runs under a copy-honesty rule: no invented claims, no fake reviews, only facts the owner confirmed. Every product roadmap also carries a list of items only I can sign off, which agents may add to but never remove. The factory can move fast because the points where judgement is needed are fixed and written down.

What this means if you’re not a software company

If you run an advice firm, a brokerage or any process-heavy regulated business, the factory matters less as a way to build websites quickly and more as an operating model. Its parts map onto your operations one for one.

Systems talking to each other by API instead of staff re-keying between them: that is your CRM, your back office, and your document production. Agents doing the repetitive middle (drafting, categorising, reconciling, filling) with the source and confidence recorded for every value, so a person reviews the uncertain cases instead of all of them. Humans at defined approval gates with an audit trail, which is the structure your compliance team already asks for. Defects converting into controls, which is what a good breach register should do and mostly doesn’t. Monitoring that tells you something broke before a client does.

The pieces add up when they’re connected. A fact-find that auto-fills the suitability report. An editorial desk that publishes to your website and social channels only after a compliance pass. A form-filling service that shows its evidence per field and routes only the doubtful answers to a person. Each of those exists today (you can inspect them on the Labs page) and together they start to look like the operations layer of a modern firm.

The honest caveats

Agents get things wrong, and the whole design assumes they will. The incident log exists because defects happen, and the governance came first: specifications, approval gates, monitoring, and the ratchet were in place before the output scaled up, not bolted on after. If you’re putting agents to work in a regulated business, getting that order right matters more than anything else, and I’ve written separately about what that governance framework looks like.

The other caveat is that the steering is the skilled part. Knowing what to build, what “done” means, which defects matter and where the approval gates go came from ten years of running operations in financial services, not from the tools. The agents supply the hands.

Looking back at the month, the speed came from the checks more than the agents. Each rule written down after a mistake meant one less thing to watch for by hand the following week. I think that’s the part that transfers to a regulated firm: write the rule down once, and the next time the same mistake comes round, the system catches it instead of a person.