Running a fleet of AI coding agents in production
I ship production software with a fleet of AI coding agents. Not a demo, not a weekend experiment. The actual software my businesses run on, built day after day by agents I operate the way I once operated radar consoles: with procedures, instrumentation, and zero tolerance for unverified state.
Most conversations about coding agents obsess over the model. Here’s the thing though: the model is the easy part. The hard part is everything around it, which turns out to be the same stuff that’s hard about human teams (just faster, and with less shame). So let me walk you through the discipline that actually holds up.
The queue is the system of record
An agent with a vague instruction is a liability. An agent pulling one scoped, claimable unit of work from a queue is an employee. That’s the whole difference, and it’s a big one.
Every agent in my fleet pulls from the same board my human collaborators use. The board decides what gets built next, not the chat transcript. Claims are atomic, so two agents can’t grab the same ticket. Scope gets a human sign-off before work starts, and finished work hands off to a testing state a human signs too. If a directive changes mid-flight, it lands on the board, because the board is authoritative and a prompt is just a suggestion.
Does that sound bureaucratic? It does, right up until you run more than two agents. Then it’s the only thing standing between you and a repository full of half-finished, overlapping branches (ask me how I know). Funny thing: the discipline you put up for your agents turns out to be exactly what your human team always needed.
Agents never hold real credentials
My agents do not have my GitHub token. They don’t have my cloud keys either. They hold exactly one thing: a scoped gateway token that lets them ask a control plane for what they need, and the control plane decides what they get, per agent, per resource.
When an agent needs git access, it gets a short-lived, repo-scoped credential minted for that one purpose, revocable at the level of a single agent. So when an agent goes sideways… and at fleet scale, some eventually do… revoking one token strands one pod. Not my identity, not the fleet. One pod.
If you take one thing from this essay, take this: the blast radius of a confused agent is set by what it holds, not by what it was told.
Why isn’t the rule in the prompt?
Because prompts don’t hold. Every system prompt in my fleet says “never push to main,” and that sentence is worth exactly nothing on its own. Agents drift, contexts truncate, and a model having a bad day will apologize sincerely after force-pushing.
So the rule lives in the transport instead. The git remote my agents see is a mediated one: branch protection, PR-only merges to protected branches, and policy checks enforced server-side where no amount of model confusion can route around them. Prompts are advisory; transport is not.
This is the same lesson every safety-critical field learned generations ago. You don’t put “do not exceed rated power” in the operator’s manual and call it a day. You put a governor on the machine.
Humans own the gates
The fleet is fast, and speed without gates is just a faster way to be wrong. Three gates stay human, permanently: what gets built (scope approval before an agent starts), what ships (review and merge to protected branches), and what the fleet may touch at all (credential grants at the control plane).
Everything between the gates belongs to the agents: implementation, tests, iteration, retries. That split is what makes the leverage real. I spend my day on judgment, and the fleet spends its day on execution. I’m not going to pretend the split was obvious from day one (it wasn’t), but once it clicked, it never un-clicked.
Why I productized it
I built this discipline piece by piece because I needed it, not because I planned a product line. The queue became TaskHarbor. The mediated git transport became RepoHarbor. The control plane holding the credentials became FleetHarbor. Together they’re the FleetHarbor suite, and every one of those products is developed, daily, by the fleet it manages. The dogfood transcript is the demo!
I’ve spent twenty years learning that good systems fit real operations, whether that’s a factory floor, a radar room, or a semiconductor test cell. Agent fleets are no different. The teams that get durable leverage from AI won’t be the ones with the cleverest prompts. They’ll be the ones that gave their agents what every effective operation gives its people: a queue, a scope, credentials that match the job, and a system that makes the wrong thing hard to do.
I'm Joseph Dattilo — engineer-founder in Lansing, Michigan, author of the FleetHarbor suite, and founder of Date Palm Media. More about me · More writing · Get in touch