The choice is not one agent or a team. It is whether you become an infrastructure company.
Anyone can wire several models together in a weekend and watch them hand work to each other. That demo is real, and it is genuinely impressive. It is also a small fraction of what has to exist before the same thing can touch a customer record, a contract, or a production credential.
What follows is not a wish list. It is the inventory already running underneath the work on the previous page, each line with the failure it prevents.
| Subsystem | So that | Skip it and |
|---|---|---|
| Plan signing and verification | a plan is bound to the exact specialists it names, and drift in either is caught before dispatch | you cannot prove what ran, or that what ran is what was approved |
| A specialist forge with content hashing | an agent is a versioned, hashed artifact with a scope, not a prompt someone edited on Tuesday | behaviour changes silently between runs and nobody can say why |
| Per-workspace filesystem containment | a step reaches its own tree and nothing else, with traversal and unpinned reads refused rather than filtered | one workspace reads another client’s files and you hear about it from the client |
| A secret vault with scrub at spawn | credentials rotate without a restart and a fixed list can never reach a child process | a key lands in a transcript, a log, or a model context window |
| An egress gateway | outbound hosts are allow-listed per vendor and provider keys are injected at the boundary, never in a prompt | a compromised step can call anything on the internet with your credentials |
| A hash-chained audit ledger | each entry hashes its predecessor, secrets are scrubbed before signing, and a per-run erase answers a data-subject request | your audit trail is a log file anyone with write access can rewrite |
| Halting ceilings | a ceiling per run and per tenant plus a cap on concurrent workers stop the job rather than warn afterwards | a runaway fan-out runs all night and nobody finds out until the invoice |
| Durable runs with a real stop | a transcript survives a reload, an operator stop halts before teardown so nothing respawns, and orphans reconcile on boot | you cannot stop a run you started, and restarts leave zombies marked running |
| A human approval queue | what an approval may do is a closed vocabulary the agent cannot extend, with single-use expiring tokens | “human in the loop” means a person clicking yes on something they cannot inspect |
| Multi-tenancy end to end | per-tenant repositories, vaults, ledgers, ceilings, scoped keys and a role check on every call | your second customer is a rewrite, not a row |
| Versioned content with baselines | a workspace can be destroyed and rebuilt, or promoted, without losing the specialists or what they were taught | context grows until quality falls, and resetting means starting over |
| Injection and command defences | untrusted content is sanitised before it enters a prompt, and shell calls are scanned for exfiltration and escalation | a poisoned document in a data room becomes an instruction to your agents |
| A rendering and delivery pipeline | a run ends in a document, an application or a page in the customer’s own brand, tied to the run that made it | the output is raw text somebody has to reformat by hand every time |
| A posture surface | every enforcement toggle can be read at its live value by someone who does not trust you | your security review is a conversation instead of a page |
This is the receipt, not an estimate.
Counted from the platform’s own repository. And the part that matters when you are weighing this: a dedicated coding agent wrote the code, and it still took four months. Typing it was never the hard part. Deciding what to build, specifying it precisely enough to hand off, and reviewing what came back was the hard part, and we did that work in this system. Build your own, and that is the work that lands on your team.
Counted across the four services that are the platform, excluding blank lines, comments and tests; the tool servers, the packs and the infrastructure are not in that number. The size is not the boast; it is the maintenance you do not take on. Model providers, tool protocols and your own compliance obligations all keep moving underneath it, and someone has to keep up.
Purpose, or plumbing.
None of that work is the work you set out to do. Nobody starts this because they wanted to own a secrets gateway. They start because they want diligence memos in two days instead of two weeks, or a research desk that does not forget last quarter, or proposals that stop eating their Saturdays.
Six months later the standing agenda is key rotation, an egress allow-list, a ledger migration, and why the audit chain broke on a reordered entry. The memos still take two weeks, because the two people who could have written them are maintaining infrastructure.
That is the real choice. Every hour on the list above is an hour not spent on the thing your customers pay you for, and the list does not end, because model providers, tool protocols and your own compliance obligations all keep moving underneath it.
Three cases, said plainly.
A page that claims there are none is not credible, and you would stop reading.
Governance is your product.
If the control layer is what you sell, buying it is buying a competitor’s roadmap. Build it, and own it properly.
One workflow, one team, no outside data.
If nothing crosses a trust boundary and nobody outside the room has to audit it, most of the list above is overhead you do not need.
A constraint no vendor can meet.
An air gap, a classification level, or a jurisdiction where an image signed outside it simply cannot land.
Buying it does not mean depending on us to keep it running. You hold the signed image in your own registry, deploys are pull-based, and there is no phone-home or licence check anywhere in the product. Pin a version and your deployment runs on your terms at the version you chose. What self-hosted means here.
Outside those three, the honest framing is this: the whole list already exists here, or you can spend months building it and own its maintenance for as long as the product lives. The weekend demo is not the thing being compared.
Then the fastest way to test it is to use it.
Thirty minutes on a real workspace with a goal of your own beats another week of comparison. If you are still weighing it, bring the objection instead; that is a better use of the call.