The Agent Factory

The agent factory

A governance committee produces rules. A factory produces agents.

---

The centre of excellence that built nothing

Twelve people. Eighteen months. Forty-seven policy documents and no agents in production.

Three floors down, a team with no mandate had shipped five agents in six months. They were generating revenue and violating three security policies.

The board asked which team to fire.

(Composite. The shape recurs often enough to be worth naming, and no single organisation is described.)

The wrong lesson is that governance slows things down. The right one is that a function measured on incidents prevented will prevent them by preventing everything, and the work simply relocates to where nobody is watching.

Gatekeeper, or builder

	The gatekeeper	The builder
The job	Say no until it is safe	Make the safe path the fast path
The metric	Incidents prevented	Agents shipped per month, at zero critical incidents
The culture	Risk aversion	Disagree and commit
The outcome	Innovation relocates to shadow IT	Governed innovation, visible

The difference is not permissiveness. Both functions block the same things. One of them also builds the road that makes blocking rare.

Three pillars

A centre of excellence that is working has three distinguishable teams inside it, each with its own metric. When one is missing, the failure is predictable.

1 · The factory. Build. Platform engineers and agent architects. Owns the reference architecture, the pattern catalogue, the grounding pipeline, the tool registry. Metric: time from idea approved to first working agent in production.

2 · The governor. Risk. Security, compliance, a legal liaison. Owns the risk tiers, the pre-flight gates, the guardrail stack, the audit trail. Metric: share of agents passing pre-flight on the first attempt.

3 · The enabler. Adoption. Training, change management, developer relations. Owns onboarding, the champion programme in each business unit, and the sandboxes. Metric: active use across business units, not licences issued.

The three failure modes, in the order they are usually met:

Factory without governor is the wild west with better tooling.

Governor without factory is forty-seven policy documents.

Factory and governor without enabler is a paved road nobody drives on.

What centralises, what does not

The hub learns. The spokes scale. Putting either job in the wrong place is the most common structural error.

The hub owns	The business unit owns
The shared platform	The domain knowledge
The approved model list and security standards	The specific prompts and business rules
Observability, cost and drift monitoring	The business KPI and adoption
The risk tier review	The signature on the risk charter
The amnesty programme for unregistered agents	Submitting through intake
Training citizen developers	Finding the work worth automating

The line is not technical against business. It is reusable against specific. Anything two business units would build twice belongs to the hub.

The four levels

Level	Name	What it looks like	The tell	To reach the next one
1	Exploring	Scattered pilots, hero developers, no standards, API keys in spreadsheets	"We have fifty proofs of concept and nothing in production."	An executive sponsor and one real win
2	Implementing	A proto team exists, first guardrails, risk tiers defined, intake is live	"We launched one agent and we are afraid to launch the second."	Platform investment. A reference architecture, not a wiki page
3	Scaling	A formal function with all three pillars, a working catalogue, reusable components	"We can ship a new agent in weeks using our standard chassis."	A cultural shift, and it is the slowest of the three
4	Optimising	Federated. Agents monitor agents. Drift correction is routine	"Our agents are identifying process bottlenecks we had not found."	Nothing. This is where the work becomes continuous

Two things about the tells.

They are diagnostic questions, not descriptions. Ask a room how many agents are running and the answer places the organisation more accurately than any assessment.

And the level 2 tell is the one that matters. Fear of the second agent is not caution. It is the discovery that the first one was built without anything reusable underneath it.

Reported time to reach each level runs from months at level 1 to years at level 4. Those bands come from reported programmes rather than measurement, and any organisation moving faster than them should ask what it skipped.

The team, by level

Absolute headcount is not portable. Shape is.

At level 1 the whole function is three people, and it has a name worth using: the proto-team. An architect who owns patterns, a governor who owns security, a builder who ships the first agent. Everything else is borrowed.

At level 2 the ratio that matters is roughly two builders to every one platform or governance person. Enablement is still a fraction of somebody.

At level 3 enablement becomes a whole role, and it is the hire most often deferred and most often regretted.

At level 4 the builders have moved into the business units and the hub is mostly platform, governance and enablement.

The trajectory is not more people. It is the same people moving outward.

The rhythm

A function that meets to receive status reports is a committee. A function that meets to make decisions is an operating model.

Weekly. One drift and incident review. One intake session with a hard time box per proposal. One open office hour. One pre-flight review. One retrospective on what shipped and what blocked.

Monthly. Portfolio review, including which agents should be retired. One red team exercise against one production agent. One demo session across business units.

Quarterly. Maturity assessment. Platform roadmap. Executive briefing with business impact, not activity.

One rule holds the whole thing up.

No steering meeting without a decision made and recorded. If there is nothing to decide, cancel it and give the time back.

_{From the practice canon. Developed through client delivery and refined in collaboration; the frameworks stated here are the author's own.}