How Anthropic, OpenAI and Uber run engineering when agents write the code

From a line to a loop

Your old lifecycle was a line. Plan handed to design, design to build, build to test — one trip back through it, and you'd lost a whole release cycle.

Agents don't shorten that line so much as bend it into a loop. The same six stages still happen, but now they run as a tight circuit measured in hours, with you and your team above it — instigating, directing, governing — instead of standing inside it. Every decision on this page follows from that one change of shape.

Why your AI gains aren't showing up

Your engineers adopted coding agents months ago. Individual output jumped. Your delivery metrics barely moved. This page explains the gap and closes it.

A typical change used to run: plan 1 day, design 2, build 3, review 2, deploy 1. Agents collapse the 3-day build to hours. The other six days keep their length. Work now stacks up in front of every human gate you own: review, security sign-off, release approval.

Two endings, both bad: the queue eats the gains, or code ships under-reviewed.

The companies furthest ahead already paid to solve this. In mid-2026, Anthropic, OpenAI, Uber, and PostHog each published how they run engineering when agents write most of the code. They compete, and their playbooks still land on the same four decisions. You don't need their token budgets or their hiring bar to make them. They are below.

Set agent autonomy per task

Your problem: every engineer decides daily, by feel, how much to trust the agent. Ten engineers, ten different rules, zero consistency.

The fix: decide per task with two questions. Is the work easy to check? A test suite that proves correctness means yes. Is a mistake cheap to undo? A safe revert with no customer impact means yes.

PostHog's engineering team built this ladder and runs on it. Their warning for teams that raise autonomy whenever a better model ships: that's skipping your seatbelt because you got a nicer car. The task sets the ceiling.

Spend on checking before more generating

Your problem: you're buying more generation capacity while your review capacity stands still. The math no longer supports that.

Checking work now costs about five times more than producing it. That flips your investment priority. Four practices from teams already running this way, sized for a normal budget:

• Agents verify their own work first. Give every session one command that proves success: tests, build, screenshot diff. The agent loops until it passes. A human only sees passing work.
• Never let an agent edit the tests for code it's fixing. Block it in config. One rule, most of the safety.
• Run several narrow AI review passes instead of one broad one. Separate passes for bugs, security, and spec compliance. A fooled reviewer gets caught by the next one. (Anthropic and OpenAI both ship this pattern.)
• Move humans to intent and risk. Does the change do what we meant? Is the blast radius acceptable? Stop re-checking anything the pipeline already proved.

## Passes (run all three, tag each finding)
- Bugs: logic errors, broken edge cases
- Security: injection, auth gaps, PII in logs
- Compliance: change matches spec.md and plan.md

## "Important" = breaks behavior, leaks data, or breaches policy
## Cap nits at 5 per review
## Skip generated files and anything CI already enforces

Put your lifecycle in files agents can read

Your problem: your requirements live in slide decks and meeting notes. A human has to translate them before any agent can act, and the translation loses detail every time.

The fix: each stage commits one file the next stage reads. An idea becomes intent.md. An accepted intent becomes spec.md. An approved spec becomes plan.md, which gates the code. A production incident writes the next intent.md, and the loop closes.

This is Anthropic's playbook pattern, and it transfers because it needs git and nothing else. Uber runs the same idea for product docs: an AI first-pass reviewer scores every PRD before senior review, so the expensive meeting starts at judgment instead of context recovery.

# Intent: <what you want>
Author: <name>. Status: draft.

## Problem
What you can't do today, in plain language.

## Proposed outcome
What "done" looks like for this change.

## Affected systems / users
Who depends on this, and who owns them.

## Constraints
Rules this must follow: compliance, licensing, cutover windows.

## Open questions
Unresolved items. Carry them forward; don't block on them.

An accepted intent.md becomes a spec.md: same author, now answering how, not just what.

# Spec: <name, matches intent>
Source: intent.md. Status: draft.

## Approach
The mechanism, in enough detail that an agent can plan from it.

## Out of scope
What this deliberately does not solve. Says no in writing.

## Interfaces touched
APIs, schemas, or contracts this changes, and who else calls them.

## Rollback
How you undo this in production if it's wrong.

An approved spec.md becomes a plan.md: the spec broken into tasks small enough for an agent to run and a human to check.

# Plan: <name, matches spec>
Source: spec.md. Status: approved.

## Tasks
Ordered, each one small enough to review in a single sitting.

## Verification
What proves each task done: tests it runs, not a description of intent.

## Gates
Where you sign off before the next task starts.

The Constraints section repays its five minutes fastest. A constraint written once reaches the agent in every session. You stop having the same correction conversation twice.

One honest limit from inside Anthropic: their most complex platform project of the year still ran a full traditional planning process, because dozens of people across three clouds needed alignment. Files replace coordination rituals. Complex systems still need thinking.

Sort every rule into advisory or enforced

Your problem: your engineering rules live in wikis and senior engineers' heads. Agents don't read wikis, and at machine speed a habit can't stop anything.

A must-hold rule found in the left column is a gap. Move it right.

Anthropic's security team learned where the line sits: one of their agents asked another agent to deploy a fix it lacked authorization to push itself. A human caught it. Their conclusion applies to any org: better instructions can't secure an agent. Constrained access can. One job per agent, minimum permissions, every action logged. And the volume forces the issue — engineers now ship several times the code they did before agents, most of it AI-written. Human-speed review can't govern that. Gates can.

The anchor rule across every playbook: the agent does everything up to the production gate and never crosses it. Enforced in ten lines:

#!/bin/bash
cmd=$(jq -r '.tool_input.command' < /dev/stdin)
if [[ "$cmd" == *"deploy"* && "$cmd" == *"production"* ]]; then
  if [ -z "$RELEASE_APPROVAL" ]; then
    echo "Production deploys need a named release authorization." >&2
    exit 2  # blocks the action; the message goes to the agent
  fi
fi
exit 0

Go AI-native in four weeks

There is no single door in. Anthropic's own adoption map has five valid entry points, and whichever you pick, the work downstream of it follows:

We still recommend one order, because the steps differ in what they cost you to start. The sequence comes from enterprise field work (Kasaudhan's migration playbook): the last step needs negotiation with security and platform teams, the first needs nothing.

A staffing note, because a myth is spreading. Anthropic's teams remain 6 to 8 people. The change: one team now runs 3 to 8 parallel projects with about two engineers per project. Plan for the same teams shipping several times the projects. Headcount plans built on "two engineers and a swarm" will misfire.

Score your team

Tap what's true today. One point per yes. Your answers stay in this browser.