Internal build caseCase 01
Building software with AI coding agents without handing them control
Comtau builds its own software with AI coding agents. This case describes the system that makes that safe: how work is decided, bounded, executed, checked and handed on.
- Client
- Comtau (internal)
- Scope
- Planning, running and verifying AI-assisted engineering work
- Disciplines
- Architecture · AI-assisted engineering · Verification
- Status
- In use for Comtau’s own software
This is Comtau’s own system, not client work and not a product for sale. It contains no client material, and internal tools are deliberately not named.
Context
A practice that advises on architecture also builds
Comtau is an architecture-first technology leadership practice. Its recommendations are meant to be carried into implementation, so Comtau needs a way to build that it can stand behind - for its own software first.
AI coding agents make implementation faster. They also make it easy to produce code that nobody fully owns: changes that drift beyond what was asked, checks that are quietly weakened to pass, and context that lives in a session instead of in the company.
The problem
Get the speed of AI-assisted implementation without handing it control.
Constraints the system had to respect
- C1A person makes every decision that is hard to undo.
- C2Work cannot grow beyond what was agreed without someone deciding it should.
- C3Whoever did the work does not sign it off.
- C4A passing check has to mean something: tests are never weakened to get there.
- C5Context has to survive the end of a session.
Decisions
Six design decisions, recorded like any other architecture decision
Each is a mechanism that runs today. Together they turn “an agent wrote some code” into a unit of work with a scope, a proof and an owner.
- D-01
Decide before building
Each significant decision is written down with its context, options and consequences, and approved by a person before implementation depends on it.
Why: Nothing is built on a decision nobody made on purpose.
- D-02
Work in bounded units
Every unit states its mission, the parts of the system it may change, what is out of scope and the checks that will prove it.
Why: Work cannot quietly grow beyond what was agreed.
- D-03
Run agents where a person can see and stop them
AI coding agents implement each unit in a fresh session from a pinned starting point. An operator can step in, interrupt or stop it at any time.
Why: Speed from AI assistance without handing it control.
- D-04
Stop instead of improvising
When a unit meets scope growth, a failing check, a conflict or a missing approval, execution stops and a person decides.
Why: A unit never resolves its own surprises; a person does.
- D-05
Separate verification from generation
Separate read-only reviews check architecture, security and evidence. Whoever did the work does not sign it off. Tests are never weakened, skipped or rewritten to make a check pass. An unexplained failure blocks closure.
Why: Progress is shown with evidence, not reported as a status.
- D-06
Close every unit with evidence and a handoff
Each unit closes with the exact commands run, their results, the tests that prove the change and the tests that prove what must not happen. Each unit ends with a handoff note the next unit reads first, so context is carried forward instead of rediscovered.
Why: Context stays with the company, not with one person.
Architecture
One chain, each stage handing a written output to the next
The system is a chain of stages. Each stage produces something written that the next one starts from, and each has a gate that must hold before the work moves on.
Human approval required
- Architecture changes
- New dependencies
- Any release
- 01
Assess
Establish the facts about the systems, the team, delivery and the business need.
Gate: Findings agreed with you
- 02
Architect
Make the architecture and technology decisions explicitly, with options and trade-offs.
Gate: Each decision approved by a person
- 03
Decompose
Break the plan into bounded units of work, each with a stated scope and its checks.
Gate: Order and scope agreed
- 04
Execute
Implement one unit at a time, AI-assisted, in observable sessions a person can stop.
Gate: Stops on failed checks, scope growth or missing approval
- 05
Verify
Run the checks, add independent review, and record what was proven.
Gate: Checks pass; reviews have no blocking findings
- 06
Hand over or continue
Close each unit with a handoff note that the next unit, or your team, starts from.
Next unit, or your team, starts here
- Mission
- One stated change, and why it is needed
- May change
- The parts of the system this unit is allowed to touch
- Out of scope
- What it must leave alone, stated explicitly
- Checks
- Tests that prove the change, and tests that prove what must not happen
- Stops on
- Scope growth · failing check · conflict · missing approval
- Review
- Independent, read-only: architecture, security, evidence
- Evidence
- Exact commands run and their results
- Handoff
- A note the next unit reads first
Execution
What one unit of work carries
A unit states its mission, what it may change, what is out of scope and the checks that will prove it. It is implemented in a fresh session from a pinned starting point, and it closes only with evidence.
Traceable runs
Each run records the prompt it was given, the model used, an event trail and its token and cost figures.
Lessons
What running it taught us about AI systems in general
Each internal control has a direct counterpart in the design of a client’s production AI system.
- Bounded scope
- In Comtau’s engineeringEvery agent task states what it may change and what is out of bounds.
- In your AI systemAgents and tools get explicit permissions and boundaries, not open-ended access.
- Stop and escalate
- In Comtau’s engineeringWork stops on a failed check, scope growth or a missing approval, and a person decides.
- In your AI systemEscalation paths to a person are designed in for the cases the system should not decide alone.
- Traceable runs
- In Comtau’s engineeringEach run records the prompt, the model used, an event trail and its token and cost figures.
- In your AI systemEvery AI action is traceable: inputs, model version, tool calls and cost.
- Verification separate from generation
- In Comtau’s engineeringOutput is checked by tests and independent read-only reviewers, never signed off by the agent that produced it.
- In your AI systemEvaluation and guardrails sit outside the component that generates the output.
- Human-owned irreversible actions
- In Comtau’s engineeringArchitecture changes, new dependencies and releases need explicit human approval.
- In your AI systemActions that cannot be undone sit behind an approval step, by design.
Building with AI and need it under control?
Tell us what you are building and where it is fragile. A senior architect will look at the situation and suggest the useful next step.
Direct conversation with a senior CTO/architect. We’ll review your situation and determine the useful next step.
Talk to a senior CTO/architect
Book a call