The self-driving company needs an enforcement layer
Amjad Masad, Replit's CEO, published a piece called "The Self-Driving Company." Its preview reports the number everyone building with AI is now living: engineers at Replit have nearly tripled code output, and review times held steady.
Read that twice. Output tripled. Review held flat.
That gap is the whole story of the next two years. When the machines that write the work get three times faster and the humans who check the work stay the same speed, the check stops being a check. It becomes a queue, then a rubber stamp, then a formality that everyone routes around because the alternative is missing the quarter. The self-driving company is real. The question is what keeps it on the road when no human is reading every turn of the wheel.
The bottleneck moved, and it moved to the wrong place
For thirty years the constraint on shipping software was writing it. Every process we built — code review, change advisory boards, approval chains, the compliance sign-off — assumed a human was the slow, expensive, careful part in the middle. Those processes work because there is a person with judgment standing between the intent and the irreversible action.
AI dissolves that assumption. When an agent can open, revise, and land a change faster than a person can read the diff, human review is no longer the careful part. It is the throttle. And a throttle that can't keep up gets removed — quietly, by people under pressure to keep the throughput the AI just promised them.
So the honest version of "the self-driving company" is not no oversight. It is oversight that runs at machine speed and does not get tired, bored, or overruled by a deadline. You cannot get that from more reviewers. You get it from a layer that decides, deterministically, what is allowed to execute — before it executes.
You can't review your way out of this, and you can't ask an LLM to
The two reflexes are both wrong.
More human reviewers doesn't scale — that's the arithmetic Masad's number exposes. Triple the output and you'd need to triple the reviewers, forever, and they'd still be the slow part.
An LLM reviewing another LLM feels like it scales, but it moves the trust problem without solving it. A probabilistic reviewer has the same failure modes as the probabilistic author: it can be wrong, it can be prompted into being wrong, and — worst of all — its verdicts are not reproducible. You cannot hand an auditor "the model said it was fine." The self-driving company needs a brake that is not itself a guess.
That brake is a deterministic enforcement layer: a rule that evaluates the action, not the intent; that returns the same verdict every time for the same input; that has no model in the decision path, so its ruling can be replayed, signed, and audited. AI can propose. Deterministic policy decides what executes.
Keep the control plane. Add authority at the action seam.
Microsoft, ServiceNow, Cisco, Palo Alto — they're all shipping what they call a control plane for AI agents: discovery, identity, observability, kill switches, inventory of every agent in the estate. Keep it. That layer is real and useful, and it's theirs.
But a control plane watches what agents did. It sits beside the work and reports on it. The self-driving company needs something one layer down: authority at the seam where an agent's decision becomes an action and the action becomes irreversible. That's the enforcement layer — the independent enforcement layer for AI-powered systems — and it rules on each action with four verdicts:
- Permit — the action is inside policy; it executes.
- Clamp — the action is out of bounds but correctable; it's rewritten to the boundary instead of killing the task.
- Deny — the action is not allowed; it never executes.
- Quarantine — the action is ambiguous or can't be evaluated cleanly; it's held rather than silently permitted.
Four verdicts, no model in the loop, before execution. A control plane can — and should — sit on top of that.
The proof case: we run our own company this way
We didn't arrive at this from a whiteboard. Containment.ai's business-execution organization is a self-driving company: ten AI agents that run growth, revenue, customer success, product, and engineering, coordinating through shared channels and shipping real pull requests across eight repositories. On a working day they open, review, and merge changes at a rate no ten-person human team would match.
Every one of those merges passes through deterministic gates that no agent can talk its way past:
- An architecture-decision gate — a required CI check that blocks any change touching a watched architectural surface unless it ships the corresponding decision record in the same change. It is not advice. It fails the build.
- A merge-risk rail that classifies sensitive files and forces the higher-approval path when a change reaches them.
- Immutable guardrails — spending limits, data-classification rules, and approval requirements the agents load as constraints they cannot edit.
- Kill switches on every autonomous capability, defaulting to the safe posture, flippable in one command.
- Signed, hash-chained audit receipts on the artifacts the team produces, so any decision can be traced back to the agent that made it.
That is what lets us let the agents drive. The gates are deterministic, so throughput going up does not make oversight go down.
And here is the part a company selling proof has to say out loud: the experimental guard we run on our own agents' tool calls — the one that mirrors our edge product — is deliberately a default-off, fail-open shadow. It observes; it does not block; we do not call it enforcement, because it isn't. The gates above are the real enforcement in our own house. We draw that line in public on purpose. If we blurred it, you'd be right not to trust us to draw it for you.
Receipts, not dashboards
The output of an enforcement layer isn't a dashboard — it's evidence. Every ruling is designed to leave a signed, hash-chained decision receipt: same request, same policy version, same verdict, replayable by whoever needs to check. Today those receipts are staging-verified, and our status page says exactly that. You can verify a sample yourself rather than take our word for it.
Periodic audit proves what was true at audit time. The enforcement layer is built to keep the evidence current at action time — which is the only time that matters once the company is driving itself.
The road ahead
Masad is right that the self-driving company is coming, and the productivity numbers are why it's coming fast. But a car that drives itself doesn't need fewer safety systems than one a human drives — it needs more, and it needs them to be deterministic, because there's no one with a foot near the brake.
Output will keep climbing. Human review won't climb with it. The layer that holds the line has to be one that never blinks, never guesses, and can prove afterward exactly what it allowed. AI can propose. Deterministic policy decides what executes.
Containment.ai is pre-ATO with no production customers, and we say so before you ask. We hold no certifications and make no certification claims; performance measurement is in progress. Decision receipts are staging-verified; inline command-bus placement is design-stage; the air-gap-capable runtime is CI-proven on our on-prem stack. We align to CSA's AARM/CS 1 spec — a standard we didn't write — with open requirements tracked in the open. Full assurance status lives on our Trust page, in plain sentences, on purpose.