Labs
All posts

Build your own software factory with Runlayer Agents

Ramp built Inspect. Stripe built Minions. The strongest engineering teams are building factories that build their software. Here’s how we built ours on Runlayer Agents, and how you can build yours without a dedicated platform team.

EngineeringRunlayer Team4 min read

A handful of companies are changing how software gets made. Ramp’s background coding agent, Inspect, now opens a large share of the company’s merged pull requests. It works in a full development environment, uses the same internal tools as an engineer, and checks its own work with tests and screenshots before anyone reviews it. Ramp’s Glass gives every employee one AI workspace with their tools already connected.

Few companies need to build a coding agent from scratch. What changes is the job of the engineering team. In OpenAI’s words, the work is “no longer to write code, but to design environments, specify intent, and build feedback loops” that let agents do reliable work. You build the factory, and the factory builds the software.

Most AI transformation leaders don’t have a team to spare for a project like Inspect. So we built our own software factory on Runlayer Agents, using only features our customers have too. Here’s a tour of what it does and what it changed about how we ship.

What a factory needs

A software factory needs four things, and Runlayer Agents provide each of them.

An agent with org-owned GitHub access
An agent with org-owned GitHub access
Building blockWhat it gives the agentIn Runlayer
EnvironmentA real place to build, run, and check its workA sandbox for every run, with a shell, a browser, and artifacts for screenshots, reports, and videos
Code accessPush branches and open pull requests, safelyAn org-owned GitHub App lent to one agent, limited to the repos you approve
TriggersWork that starts on its ownSchedules, webhooks, connector events, and @mentions in Slack or Teams
ContextWhat an engineer would knowConnectors to Linear, Sentry, Slack, and more, plus agent memory

The assembly line

Agents run every stage up to the merge. A person approves every change that ships.

STAGE 01Intakefeedback from the UI,Slack, or a scheduleSTAGE 02Buildreproduce, fix, test,before/after shotsSTAGE 03Reviewautomated review,agent answers itSTAGE 04Verifyan agent clicksthrough the changeSTAGE 05Approvea human approvesevery changeAGENTSHUMANthe authoring agent keeps coming back until the PR is ready
Fig. 1. Agents run every stage before the merge. A human approves what ships.

Intake: feedback from anywhere

Anyone at Runlayer can point at the part of our product that’s wrong, describe the fix, and send it straight to an agent. The same agent takes requests from Slack threads, and other agents in the factory run on schedules or react when something changes in a connected tool.

Build: reproduce first, then fix

The agent reproduces the problem before it changes anything, then makes the smallest fix that works, with a test. For anything visible, it attaches real before and after screenshots to the pull request, asks the person who reported the problem to review it, and messages them when it’s ready.

Review: the loop keeps going after the PR opens

Every pull request gets an automated code review. The agent that wrote the PR keeps coming back to it, answers review comments, fixes failing checks, and asks for a fresh review. When it can’t make progress, it hands the PR to a person.

Verify: an agent clicks through the change

A separate agent can run the change in a real browser and post the result, with a screen recording, on the pull request.

Approve: people own judgment

Every change needs a human approval before it merges. Engineers spend their time deciding what should ship, while the agents handle the chores around it.

Secure by design, from the first commit

A factory that writes code needs stronger guardrails than one that doesn’t, and the most important one is how agents reach your code.

ADMIN, ONCEGitHub Appowned by your orgPER AGENTLent to one agentapproved repos onlyEVERY PUSHShort-lived accessnothing long-livedin the sandboxON GITHUBBot identitynever a person’saccount
Fig. 2. Agents never hold a long-lived GitHub credential.
  • Admins connect a GitHub App your organization owns, then lend it to one agent for an approved set of repositories.
  • Commits and pull requests come from the App’s bot identity, never from an employee’s personal account.
  • Agents can’t change workflows, secrets, or repository settings.
  • Disabling the agent or removing its access cuts it off right away.
  • A network access policy can limit the agent to GitHub and your package registries, and every push sits in the audit trail.

Start building your factory

You don’t need to build Inspect to get what Inspect gives Ramp. Start with one loop: point an agent at a repository, give it a webhook or a Slack channel, and let it turn feedback into reviewed pull requests. Add review and verification as you go. Runlayer is the leading AI control plane, with AI enablement, security, and control in one platform, so your factory is secure by design from day one. See how → book a custom demo.

Runlayer is the leading AI control plane, with AI enablement, security, and control in one platform.