AI-assisted analysis. See our editorial policy.
Human editorial review not recorded
Buried near the end of this session is the most useful sentence in it. Three agentic products are in production, one is about to launch, and one was taken back to the drawing board — and that last one, they say, produced some of the most valuable data they got (38:00).
Enterprise conference sessions are not usually where you learn what failed. That this one names a reconsidered product at all is worth more than the architecture diagrams around it.
Testing something that does not behave the same way twice
The technical argument the session builds toward concerns verification, and it starts from a limitation rather than a capability: traditional testing only goes so far, because these models are probabilistic (31:37).
That sentence quietly invalidates most of an enterprise QA apparatus. A test suite assumes that identical input produces identical output, and that a passing run means the behaviour is correct. Neither holds. You are not testing a function; you are sampling a distribution and hoping the samples you drew are representative.
Their answer is to shift from checking outputs to measuring properties. They track relevance, completeness and tone — the things that matter for customer conversations — while noting that other organisations will need different measures (32:59).
The second half of that is the part people skip. These are not universal metrics. They are the qualities Cox decided mattered for a dealer talking to a customer, and importing them into a different product would produce confident measurement of the wrong thing.
Two kinds of guardrail
The distinction between hard and soft guardrails (29:20) is a small piece of vocabulary that clarifies a lot.
Hard guardrails sit above the model and prevent certain inputs from reaching it at all. Soft guardrails steer behaviour within the model's operation. The first is deterministic and cheap; the second is probabilistic and expensive, and inherits every reliability problem the model has.
Which means the design question is how much of your safety requirement you can push into the deterministic layer. Anything you cannot is a requirement you are enforcing with a technique that occasionally fails, and you should know which of your requirements are in that category.
Red-teaming as a schedule rather than a gate
Their adversarial testing practice runs before alpha, before beta, and continues into production, with every exploit catalogued and fixed (28:02).
The scheduling is the substance. Security review as a gate assumes the thing being reviewed stops changing once it passes. For a system whose behaviour shifts when the underlying model is updated, when a prompt is edited, or when a new tool is connected, a gate certifies a system that no longer exists by the time it ships.
Treating it as a recurring activity is more expensive and is the only version that describes reality.
The scale that makes this a specific problem
The context numbers explain why they built this way. Roughly 5.1 trillion insights about vehicles in the market, and hundreds of millions of customer interactions (7:46) — against an infrastructure history of consolidating from fifty data centres to three in 2018 (9:40).
That is an organisation with a decade of practice at operational consolidation, which is exactly the background that produces this session's instinct: start from a foundation that can evolve, and a later migration takes two weeks rather than several (26:41).
The instinct is sound and the generalisation is limited. A company without that data volume faces different economics, where the foundation costs more than the migrations it saves. The blueprint in the title is a blueprint for organisations that already look like this one.
Key numbers
Talk chapters
Key takeaways
- 01
Three products are in production and one was reconsidered entirely, which they describe as some of the most valuable data they collected. 38:00
- 02
Traditional testing has a ceiling here because the models are probabilistic, so a passing run no longer certifies the behaviour. 31:37
- 03
They measure relevance, completeness and tone rather than checking outputs, and warn that other organisations need different measures. 32:59
- 04
Hard guardrails intercept before the model runs while soft guardrails steer inside it, which makes the deterministic layer the safer place for requirements. 29:20
- 05
Red-teaming runs before alpha, before beta and continuously in production, with every exploit catalogued and fixed. 28:02
Entities mentioned
Related talks
The practical counterpart to the argument made elsewhere this season that specification is what contains model entropy. Raval and Harris name the failure they are addressing precisely — a prompt-and-pray loop in which working code arrives with no record of what the model assumed, which requirements were fuzzy, what design was chosen or why, leaving nothing to review and nothing to iterate against when a defect surfaces months later. Their answer is three committed markdown artefacts: requirements written in a structured requirements syntax with acceptance criteria attached to each user story, a design document carrying technical decisions together with the reasoning behind them, and a task list whose entries cite the requirement numbers they satisfy. The traceability is the point — a reviewer questioning a decision in a pull request can follow it back through the task to the design to the requirement, all in the same repository. Notably they keep the human between each phase rather than after it, with the agent surfacing ambiguity as questions before proceeding.
Drawn from a year of engagements with more than a hundred companies, this is the most direct challenge in the season's programme to the assumption that faster code generation produces faster delivery. Mishra and Raja open with external evidence rather than their own: an industry study putting realised velocity gains in the ten to fifteen per cent range, and a controlled experiment in which developers using AI estimated themselves roughly a fifth more productive while measurement showed them a fifth slower. Their diagnosis is that both prevailing working styles fail for opposite reasons. Handing an ambiguous problem to an agent and awaiting a finished result produces a volume of code the developer must nonetheless sign for and cannot confidently review, so it stalls before production. The senior engineer's alternative — decomposing the work personally and inserting AI into narrow slots — keeps the intellectual load exactly where it was, and leaves the surrounding process untouched, so hours saved in editing are consumed by the meetings that process still requires.
Brooker builds the definition from the bottom up rather than asserting it, using a deliberately absurd arithmetic task to separate three categories: what a model computes reliably as a fixed function of its input, what merely needs to arrive in the system prompt, and what genuinely requires reaching into the world. Only the third category justifies a tool, and the distinction matters because most production disappointment comes from tools built for the first two. His working definition follows — a system given a goal that loops between inference and tool calls until it reaches one — with the observation that modern agents increasingly embed code in their definitions, not for expressiveness but because replacing inference steps with deterministic code improves reliability while lowering both latency and cost. The remainder covers what production actually demands around that loop: somewhere to run, memory that persists preferences, a gateway to internal and external tools, evaluation, and formal methods applied to policy.
The most concrete attempt this conference season to answer a question the agentic coding sessions mostly leave open: if commit counts and hours saved are the wrong measures, what replaces them? Otto's account is unusually specific about why the obvious alternative fails — summing the small time savings a platform team delivers produces figures exceeding a hundred per cent of a developer's time, and a minute returned is not code in production. Their replacement borrows from Amazon's retail supply chain, where cost to serve measures what it takes to place a package on a doorstep, and applies the same shape to software: total cost divided by units of delivery, with the unit chosen to fit the team. The supporting research is the more quotable finding — across tens of thousands of developers over five years, individual velocity reverts to the team's mean, making team velocity the strongest predictor of both individual output and perceived productivity, which is the empirical case against measuring individuals at all.
The framing statistic is organisational rather than technical: around eighty per cent of organisations expected to have platform engineering teams going into 2026, up from about forty-five per cent a couple of years earlier. The interesting part is the doubling. The problem described is teams solving the same problems separately, producing inconsistency and redundancy — dangerous not because of duplicated effort but because each independent solution has its own security properties, and the organisation's real posture is the weakest rather than the average. The most valuable content is that two financial services organisations went in diametrically opposite directions on workload identity and both are described as working, which implies the choice is determined by context rather than by a general answer. The honest note follows immediately: even with standardised patterns the result remains fragmented.
The line that explains this session comes from the customer in the last ten minutes: they are preparing for a world where metadata is how agent-based systems find the data they need and access it through the controls being built. That relocates a function — governance has spent two decades as compliance activity describing data that people locate by other means, and if agents navigate by the catalogue then the catalogue stops describing the access path and becomes it. An incomplete catalogue is a documentation problem when humans can ask a colleague; an agent has no such workaround. The most honest moment addresses the perennial failure that rules get written and ignored, with enforcement rather than publication as the argument. Generated descriptions and greyed-out classification suggestions divide the labour correctly, keeping a person accountable while removing the burden of finding candidates.