A stated exit does not price the exit
Stripe rebuilt its organisation chart around one-sentence charters, Inkitt gave its agents almost none of the firm's credentials, and one measurement says a model upgrade can pass every public benchmark and still be a downgrade.
How we Organise
Pratik Gupta ran large infrastructure fleets at VMware for over a decade. He now leads three teams at Stripe, and his essay describes the design he operates. Half a dozen pods each carry a one-sentence charter. It names what the pod owns and what it does not. Charters roll up into team and organisation charters. A request that fits none becomes a visible leadership decision. Ownership runs from building through operating to decommissioning. Scope drift is reviewed on paper. A pod at 120 per cent of its charter counts as failure, not success.
The claim behind it is ours as well: what sets the size of a team, in our account, is the version of the problem the team can hold in mind. This is the first named account of a large firm running that rule as a production design rather than as a slide. It comes from one leader across two organisations. There is no dataset and no counterfactual. It demonstrates that the rule runs somewhere, which is not the same as everywhere.
A team’s size is set by what it can hold in mind, not by what it was given in budget.
How we Build
Inkitt’s agents write pull requests daily while holding almost none of the firm’s credentials
Inkitt automated the path from a task in Slack or Linear to a draft pull request, and reports the workflow shipping code daily. A small orchestrator owns every credential and performs every side effect. The short-lived containers that run the agent stages hold a short-lived repository token and a model key, and nothing else: no Slack or Linear credentials, no cloud identity, no network access for arbitrary calls. A gate on forbidden paths runs once before code is written and again on the real diff. The workflow refuses migrations, shared contracts, CI configuration, authentication and payment code. A person marks each pull request ready for review.
We hold that no run should out-reach the person who asked for it. Inkitt’s containers carry strictly less than that. The arrangement is plumbing on a live pipeline, not a slide in a design deck. The thin part is the population: one firm, one class of small tasks, and no published failure count.
The scope a run carries in development is the scope it runs under in production, and never more than the person who initiated it holds.
How we Assure
Toloka graded 21,330 agent trajectories on 711 frozen enterprise workflow tasks. Grading read the exact final database state alone. Every effort-matched GPT-5.6 configuration went backwards against GPT-5.5. The deficits ran 3.7 to 8.7 points, at Holm p of 0.0016 or stronger. The same models led on seven of eight public evaluation lanes, while two-thirds of the regressions were surplus action or a wrong written value and retrieval failures were almost absent.
The rule we ask of every client is that each outside dependency has an exit written down. The awkward part is smaller and harder. The exit a provider names, migrate to the recommended replacement, can pass every public benchmark and behave measurably worse. We said the cleaner thing about this on 4 October, when AWS published Bedrock’s lifecycle policy. Toloka’s measurement is the harder reading, though it warns itself that different collection windows leave serving-side drift open. A firm running the same kind of panel on its own workflows would settle the argument faster than either source can. We would like to read it: write to transform@dromologue.ai.
Everything the team depends on from outside the firm has a stated exit.