The
BottleneckMoved.
Platform Engineering
When AI Writes the Code
Guilherme
Writing code by hand
is over.
73%
of developers who use AI coding tools use them daily.
Only 6.6% trust it for important work decisions.
Stack Overflow Developer Survey 2026 · 30,000+ responses
Guilherme
(Gui).
Engineering Manager at synvert xgeeks
Platform, cloud, infrastructure… and now AI, like everyone else.
Interested in AI & robotics
self-rightingSO-101 armsvacuum teardown
What I saw first-hand.
- 01PRs started piling up.
- 02Reviews got slower and shallower.
- 03More bugs reached production.
My experience, not company data. So I asked: how do we know this code does what we intend — and trust it in production?
The volume is real.
+75%
PRs per developer, in one year.
40%+
of pull requests on GitHub start with an agent’s first draft.
DX, 500+ engineering organizations, Q4 2025 → Q3 2026 · GitHub Octoverse, Oct 2026 · vendor data
The bottleneck moved.
More changes. Same human bandwidth.
“AI increased the capacity to produce change. The next constraint became our ability to verify it.” — Spotify, Sep 2026
AI is load-testing
your SDLC.
More changes get through. More of them break.
Illustrative · DORA ROI report, Apr 2026: AI volume is “overwhelming existing deployment pipelines and manual review gates”
Make developers faster.
Make fast developers safe.
Trust more AI code, with less human review.
“The platform team, which was created specifically to remove bottlenecks, has become one.”
Koray Oksay, CNCF blog, “Guardrails, not gates”, Oct 2026
Enforce what machines can check.
Reserve judgment for intent and risk.
Machines check
- types · lint
- tests
- runtime evidence
- targeted formal checks
Humans decide
- intent
- acceptable risk
- final decisions
Fix the environment, not the agent.
“every mistake and bad pattern you observe from agents, needs to turn into a constraint”
Lauren Tan · engineer at SpaceXAI (xAI) · Oct 2026
01Every failure→a check
02Checks that keep holding→earned trust
03Earned trust→fewer changes need a human
1 identity2 sandbox3 feedback4 review5 context6 limits7 release
The verification loop.
1 identity2 sandbox3 feedback4 review5 context6 limits7 release
Least privilege, per agent.
Built for humansagents borrow your token
→Built for agentsevery agent gets its own scoped identity
First stepGive agents their own read-only token. Writes go through a separate job.
GitHub — read-only agents by default · Feb 2026
1 identity2 sandbox3 feedback4 review5 context6 limits7 release
A disposable box per agent task.
Built for humansone shared staging environment
→Built for agentsa fresh, isolated box per task
First stepRun each agent task in an isolated sandbox, with no production credentials.
Stripe — one devbox per task · Feb 2026
1 identity2 sandbox3 feedback4 review5 context6 limits7 release
Errors written for the agent.
Built for humansCI logs a person reads later
→Built for agentserrors written as fix instructions
First stepLet agents run your end-to-end tests in their sandbox, before the PR.
Uber — a validation gate before any human · Oct 2026
1 identity2 sandbox3 feedback4 review5 context6 limits7 release
Review routed by risk.
Built for humansevery change waits for a person
→Built for agentsrisk decides who reviews
First stepWrite down which changes may take the fast path: small, bounded, with evidence.
Cloudflare — three risk tiers · Apr 2026
1 identity2 sandbox3 feedback4 review5 context6 limits7 release
Context is a platform product.
Built for humanswikis for new hires
→Built for agentscontext shipped with the template
First stepAdd a short AGENTS.md to your service template.
Cloudflare — AGENTS.md in ~3,900 repos · Apr 2026
1 identity2 sandbox3 feedback4 review5 context6 limits7 release
Trace every action. Cap every loop.
Built for humansretry until it's green
→Built for agentscapped loops, every action traced
First stepCap agent CI retries at two, then hand the branch to a human.
Stripe — two CI rounds, then a human · Feb 2026
1 identity2 sandbox3 feedback4 review5 context6 limits7 release
Production is the last check.
Built for humansdeploy and hope
→Built for agentssmall rollout, automatic rollback
First stepRelease behind a canary that rolls back on its own — and turn every rollback into a test.
Spotify — stronger rollout and rollback · Sep 2026
Measure the new bottleneck.
Fix one, and it moves again. Keep measuring.
Waiting queue ageBreaking revertsTrust % humanOutcome did it work?
Queue ↑ · failures flat
Work is waiting.
Find where — often review. Automate checks.
Queue flat · failures ↑
Checks are too weak.
Turn each failure into a rule.
Both ↑
Overloaded and leaking.
Slow the agents down first.
Both flat
Healthy.
Add agents, carefully.
Faster and safer.
CompanyWhat they changedResult
SpotifyStronger review, testing, rollout and rollback8.1k → 17k merged changesno rise in reworkAug 2025 → Aug 2026
CloudflareAI review sorted into three risk tiersfirst review: hours → 4 min0.6% sent to a human48k merge requests, 30 days
AtlassianAI review on every pull requestfirst review: 18 h → 0PR cycle time −45%Jan 2026
MetaTests generated for risky changes before they landserious privacy incidents −20%H1 2026
AnthropicClaude Code teamReview tiered by risk, AI review rounds capped, gradual release2× merged PRs−40% revertsJun → Sep 2026
Company engineering blogs, Jan – Oct 2026
When code becomes cheap,
trust becomes expensive.
Your platform is how
you scale trust.
Thank you · Obrigado
Guilherme · KCD Porto × DevOpsDays Portugal 2026
