AI factory engineering is replacing the editor as the control point

At a glance

What this is: This field report argues that the practical control point for AI agent delivery has shifted from writing better prompts to engineering the surrounding harness, especially orchestration, verification, isolation, and permissions.

Why it matters: That matters because AI systems that can act, iterate, and keep working overnight need governance at the runtime layer, not just at the model or editor layer, which directly affects IAM, NHI, and review controls.

Context

AI factory engineering is the control problem that appears when AI agents move from one-off drafting into repeated production work. The article frames the harness as the real operating surface: instructions, context, tools, review loops, isolation, and permissions determine whether the system is safe to run at scale. For identity and access teams, the relevant question is no longer only who can log in, but what the agent can reach, when it can act, and how that access is bounded.

The article's core message is that production AI work changes the governance model, because speed amplifies both good judgment and bad structure. If the harness is weak, faster delivery simply produces faster mistakes. That intersects with identity governance because agents operate as delegated non-human actors, so access scope, approval flow, and runtime separation become part of the delivery system rather than separate security chores.

Key questions

Q: How should teams govern AI agent work when agents can act overnight?

A: Teams should treat overnight agent runs as controlled production processes, not casual automation. The key is to define task scope, isolate the runtime, and require human approval before any candidate change becomes durable state. If those controls are missing, speed simply increases the rate at which mistakes and overreach reach production.

Q: Why do AI agents change access management requirements?

A: AI agents change access management because they can make runtime decisions, select tools, and continue actions without a human approving each step. That means authorisation can no longer be treated as a one-time permission grant. Teams need controls that bind action, scope, and accountability together throughout the session.

Q: What breaks when AI agents run without hard isolation?

A: Without hard isolation, a compromised or misled agent can reach credentials, files, network targets, or production systems that were never meant to be in scope. Soft prompt rules are not enough, because non-deterministic models can ignore or reinterpret them. The result is data exposure, unsafe tool use, and actions that cannot be reliably contained or rolled back.

Q: Should organisations prioritise verification or speed when adopting agentic delivery?

A: Verification should come first because speed without a trusted review gate only produces faster defects. The practical trade-off is not choosing one over the other, but ensuring that review, tests, and approval happen before the change is merged or deployed. Otherwise the organisation is optimising output volume while weakening control over correctness.

Technical breakdown

Harness engineering replaces prompt quality as the control point

A harness is the system around the model: instructions, context, tools, execution paths, review loops, and permissions. In production, the model is only one component in a larger control plane, and most failure modes emerge from how those components are arranged. If context is broad, the agent wanders. If permissions are too open, it can do too much. If review is weak, bad output can move downstream before anyone notices. The article's point is that dependable AI delivery comes from structuring the harness so correctness is enforced outside the model itself.

Practical implication: Treat agent governance as system design, not prompt tuning, and review the full execution chain before expanding usage.

Isolation and permission boundaries define safe parallel execution

AI factory architecture depends on separating work into sandboxes, worktrees, and bounded runtimes so multiple sessions can operate without colliding or leaking privileges. That matters because agents are not just generating text, they are editing code, calling tools, and sometimes reaching into repos, test systems, and deployment paths. The security boundary therefore sits around the execution environment, not inside the model. When isolation is weak, parallelism becomes a risk multiplier rather than a productivity gain. For identity teams, this is the non-human identity problem in practice: each agent session needs narrowly scoped, revocable access.

Practical implication: Map every agent to a bounded runtime and explicit permission set, then make those scopes easy to revoke and audit.

Verification has to sit before merge, not after damage

The article repeatedly separates candidate generation from commit authority. Agents can draft code, run checks, and surface issues overnight, but human approval remains the final gate before changes merge. That is a crucial control pattern because it shifts trust from the agent's confidence to the organisation's verification process. The important design choice is not whether AI can work continuously, but whether the pipeline detects errors before they become durable state. In governance terms, review is no longer a courtesy step. It is the control that keeps accelerated delivery from becoming accelerated defect propagation.

Practical implication: Make verification mandatory at the boundary where agent output becomes production change, and do not let autonomy skip that checkpoint.

NHI Mgmt Group analysis

AI factory engineering is becoming the real governance layer for agentic systems. The article shows that the decisive question is no longer model choice alone, but how work is framed, executed, checked, and released. That means the control problem has moved into runtime orchestration, where identity, access, and review must be treated as part of the production path. Practitioners should govern the harness as seriously as they govern the application.

Non-human identity controls now matter at the session level, not just the account level. An AI agent can be given a narrow task, a bounded runtime, and just enough access to complete work, but only if permissions are engineered into the workflow. That is a governance shift for NHI programmes because the useful unit of control is the task session, not a permanent service account with broad reach. Practitioners should design for session-scoped access and revocation.

Verification debt is the hidden cost of agent speed. The article's repeated emphasis on review, testing, and human approval is a signal that faster creation without stronger validation simply increases the rate of incorrect change. This is the same pattern identity teams see when lifecycle controls lag behind access growth. Practitioners should treat verification as a first-class control, not an afterthought appended to automation.

Harness engineering creates a new named risk: control-surface drift. As teams move from editors to consoles, the place where decisions are made, checked, and approved shifts away from the human-visible interface. That creates drift between where work appears to happen and where real authority is exercised. Practitioners should document and audit the actual control surface, not the tool people happen to use.

The market signal is clear: autonomy is being normalised before governance is mature. The article shows teams running agents overnight, layering skills, and embedding them into delivery loops before most organisations have formalised their access and review model. That does not mean the approach is wrong, but it does mean security and IAM teams have to catch up structurally. Practitioners should assume agentic delivery is becoming standard and govern accordingly.

From our research library:

• Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
• Read next: Agentic AI Security Guide

What this signals

Control-surface drift: as AI work moves from editors into consoles and background runtimes, security teams need to map where authority actually lives. The visible interface is no longer the whole control plane, so access reviews must include orchestration layers, tool bindings, and approval gates.

The article also reinforces a broader IAM lesson: delivery speed does not remove the need for governance, it increases the cost of weak boundaries. Teams that treat agent sessions like ordinary user sessions will miss the need for scoped execution, explicit revocation, and traceable approvals.

A practical programme response is to build agent controls around issue framing, isolation, verification, and release authority, then tie those controls back to identity lifecycle rules. That gives security, engineering, and product a shared way to govern non-human actors without slowing the whole delivery system down.

For practitioners

• Define agent task boundaries before granting access Document what each agent session is allowed to do, which repos or systems it may touch, and which actions always require human approval. Keep the boundary narrow enough that a bad run cannot become broad operational damage.
• Use isolated runtimes for parallel agent work Run agents in separate worktrees, sandboxes, or containerised environments so concurrent tasks do not collide on ports, files, or credentials. Separate execution reduces blast radius and makes failures easier to attribute.
• Require human sign-off at merge and deployment gates Let agents produce code, tests, and review suggestions, but keep the release decision under explicit human control. The important control is the point where candidate output becomes durable change.
• Convert recurring mistakes into deterministic checks When an agent repeats the same class of error, turn that pattern into a rule, test, or lint check rather than relying on repeated prompting. That is how review comments become durable governance.
• Track permissions at the session level Treat each agent run as a short-lived identity with a named purpose, limited scope, and clear offboarding point. Broad standing access makes it harder to prove who or what was authorised for a given action.

Key takeaways

• AI agent adoption is shifting the decisive control point from prompt quality to the harness around the model, including orchestration, verification, isolation, and permissions.
• Production AI systems need governance at the runtime layer because delegated agents can act faster than manual review models were designed to observe.
• The safest operating model is bounded agent execution with session-scoped access, isolated runtimes, and human approval before durable change.

Key terms

• AI factory: An AI factory is an on-premise or hybrid computing environment built to train, deploy, and operate AI at scale. It combines GPU clusters, storage, orchestration, and identity controls into a single production system where access management and workload governance are tightly coupled.
• Harness: The harness is the layer of instructions, policies, and approval logic wrapped around an AI agent. It is where organisations try to constrain behaviour, but it only works if the rules are explicit, current, and enforced outside the model itself.
• Agent: An agent is software that can take an open-ended task, decide which tools to use, and act across multiple steps without a fixed script for every branch. In identity and security terms, the key issue is that an agent can change state in real systems, so its permissions and boundaries must be tightly governed.
• Control-Surface Drift: Control-surface drift is the gap that appears when the place where work seems to happen no longer matches the place where authority is actually exercised. In AI delivery, this means the visible editor may matter less than the orchestration console, permissions layer, or approval gate that truly governs output.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management for teams that need to govern delegated access. It helps practitioners connect identity controls to the delivery systems that increasingly rely on AI agents.