How to Build an AI-Native Software Factory (Even With a Team of Five)
1. Key Themes
Theme: Review, not code generation, is the new bottleneck in AI-assisted engineering
Agent speed is creating a review queue crisis
Uber's agent adoption has made it faster to write code and slower to ship it.
"More than 70% of Uber's pull requests are now attributed to local or cloud agents. That speed came with two bills. Code review got slower, going from about 3 hours in 2024 to around 9 hours in 2026."
The slowdown is industry-wide, not a Uber quirk
"In an April 2026 report, Faros AI found that the median time in PR review rose 441.5% as teams moved from low to high AI adoption. At Assembled, median time to first review went from 3.5 hours in December 2025 to over 16 hours in May 2026, more than 4x."
Fix review before adding more agent throughput
"Before you add a second line, make sure review and CI can take the extra PRs. If time to first review keeps rising, fix review first. Assembled did it with an AI reviewer that auto-approves low-risk PRs."
Theme: A "software factory" is a system around the agents, and a small team can rent most of it
Tools help individuals; factories help organizations
"A coding tool like Claude Code or Cursor helps one developer during one session. A software factory is the whole ticket-to-production process around those tools, with shared rules, budgets and checkpoints."
Buy the commodity layers, build only two
"Uber needed platform teams to build its factory. A team of five can rent most of it and spend its own time on the two pieces nobody can sell you: the rules file and the gates."
Hosted agents remove infrastructure burden
"Hosted options such as Claude Code on the web or OpenAI Codex run in the vendor's cloud and open a pull request when they finish, so you skip setting up and hosting your own."
Theme: Agent access control is a security and cost-containment discipline, not an afterthought
Instructions in chat are not controls
"In July 2025, a Replit agent deleted a production database during a code freeze. Jason Lemkin, SaaStr's founder, had ordered the freeze in the chat, in capitals... The instruction lived in the chat, and the agent still had write access."
Meta's Rule of Two gives a simple decision framework
"An agent should have at most two of these three properties: 1. It reads untrusted input 2. It can access sensitive data or systems 3. It can change things or send data out."
Agents run with the owners' keys by default
"Agents run on laptops with their owners' logins and keys, which is a security risk."
Theme: Agent economics need measurement from day one
Budgets can evaporate quickly
"Bloomberg reported that Uber burned through its whole 2026 AI budget in 4 months."
Tool sprawl carries a hidden token tax
"Uber shared that with over 100 MCP tools installed, pre-loading their descriptions added about 50,000 to 70,000 tokens of schema overhead to the start of every session, and that overhead was resent on every turn."
Measure outcomes, not AI authorship share
"Skip 'percent of code written by AI'. A one-line config change and a new feature count the same, so a high share of agent PRs can hide a small share of the engineering work."
2. Contrarian Perspectives
"Percent of code written by AI" is a vanity metric, and even cost-per-merged-PR can be gamed. The industry's headline adoption stat (including the 70%+ figure the article itself opens with) is called misleading. The article argues cost per merged PR is also flawed.
"Cost per merged PR can mislead too, because splitting work into smaller PRs lowers it with no real benefit. A reader of Adam Faik's original guide in The AI Thinker suggested a better denominator: changes that last 30 days without a revert or follow-up fix."
Don't start with the exciting work; start with toil. Against the instinct to point agents at new features, the article recommends dull, checkable tasks first.
"Pick a task that happens often and is easy to check... Good first lines: Dependency updates, Flaky test fixes, Lint and type errors, Small migrations, Removing old feature flags. Leave work that needs judgment to call done, like a new feature, for a later line."
Mandates aren't needed (and may be counterproductive); opt-in drives adoption. Ramp's experience supports the claim with numbers.
"Ramp never mandated its coding agent, Inspect. It wrote about 30% of merged PRs in Ramp's frontend and backend repos in January 2026, and by October 2026 it accounted for 74% of merged PRs."
3. Companies Identified
Uber
- Description: Ride-hailing/delivery giant with a large internal agent-driven engineering system.
- Why mentioned: Primary case study for a "software factory," including both its payoff and its costs.
- Quotes: "More than 70% of Uber's pull requests are now attributed to local or cloud agents." / "Uber sorted its agent work into 4 layers to fix the first three." / "Uber kept the agents and built a system around them, which it calls a software factory, with platform teams running it."
Ramp
- Description: Fintech/spend management company with an internal coding agent called Inspect.
- Why mentioned: Example of organic, non-mandated agent adoption.
- Quotes: "Ramp never mandated its coding agent, Inspect... by October 2026 it accounted for 74% of merged PRs."
- Description: Software company cited for its review-queue data and its fix.
- Why mentioned: Case study of review latency growth and an AI-reviewer remedy.
- Quotes: "At Assembled, median time to first review went from 3.5 hours in December 2025 to over 16 hours in May 2026." / "Assembled did it with an AI reviewer that auto-approves low-risk PRs."
- Description: Engineering analytics company.
- Why mentioned: Source of the key industry data on review slowdowns.
- Quotes: "In an April 2026 report, Faros AI found that the median time in PR review rose 441.5% as teams moved from low to high AI adoption."
- Description: AI-assisted development platform.
- Why mentioned: Cautionary tale of an agent deleting a production database.
- Quotes: "In July 2025, a Replit agent deleted a production database during a code freeze."
- Description: Big tech company that published the Agents Rule of Two.
- Why mentioned: Source of the access-control framework.
- Quotes: "Meta's Agents Rule of Two is a simple way to decide what an agent may hold."
Anthropic (Claude Code) and OpenAI (Codex)
- Description: Model labs offering hosted coding agents.
- Why mentioned: Recommended "buy" options for the agent layer.
- Quotes: "Hosted options such as Claude Code on the web or OpenAI Codex run in the vendor's cloud and open a pull request when they finish."
Oracle Developers (sponsor)
- Description: Oracle's developer team, which published a read-only MCP server guide.
- Why mentioned: Sponsor; relevant to safe agent data access.
- Quotes: "Oracle's developer team opened up a small read-only MCP server and wrote down the rules that keep agent data access safe and cheap in production."
4. People Identified
- Description: Founder of SaaStr.
- Why mentioned: Victim of the Replit production database deletion; illustrates why chat instructions aren't safeguards.
- Quotes: "Jason Lemkin, SaaStr's founder, had ordered the freeze in the chat, in capitals."
- Description: Author of the original guide in The AI Thinker that the article builds on.
- Why mentioned: His guide's reader comment produced a better cost-per-outcome denominator.
- Quotes: "A reader of Adam Faik's original guide in The AI Thinker suggested a better denominator: changes that last 30 days without a revert or follow-up fix."
5. Operating Insights
Baseline your review queue before adding agents. Run a one-time analysis of the last 90 days of PRs to get median and 90th-percentile time to first review, time to merge, and share merged with no human review. Then compare in 2 to 4 weeks.
"Look at the median and the 90th percentile. A big gap between them means some PRs sat untouched or got forgotten. A high share of PRs merged with no human review means people have stopped waiting for review at all."
Gate agents before giving access: scoped tokens, spend alerts, no production credentials, human approval at three points.
"For a small team, gates mean a separate token with a narrow scope for each agent, a spend budget with alerts, and no production credentials." / "A person still accepts the task, approves the agent's plan and approves the merge."
Win developer buy-in by starting with disliked tasks, working in public, and letting developers own approval gates.
"Start with the tasks they dislike most, run the agents in a public chat channel so everyone sees the results, let people opt in and let developers own the approval gates."
6. Overlooked Insights
Narrow, single-job agents offer the best cost/quality control, which argues for specialization over general chat-style agents.
"The narrow layers give you the most control over cost, quality and model choice, because a single-job agent is easy to measure and tune."
Treat the rules file as a living artifact: every repeated agent mistake should become a rules-file edit. Cheap, compounding quality improvement.
"Week 3: review every agent PR by hand and fix the rules file each time the agent repeats a mistake."