We set the direction. Systems run the work.

An AI-native company is not a room full of chat windows. It is a company in which recurring work is designed as a system: observable, bounded, and owned. We keep the goals, the taste, and the decisions that are hard to undo.

There is no universal standard under that name. What follows is the operating model we want. Workflows before bots. Autonomy with a boundary. One shared layer across the products. A measure that is not how much AI we used.

The term

A tool at the edge is not the operating layer.

A 2026 OECD paper on agentic AI notes that even the ideas of agents and agentic systems are described differently from one source to the next. Microsoft uses a related name, Frontier Firm, for organizations "powered by intelligence on tap." That phrase is theirs. Our test is plainer.

Machine intelligence is an operating layer. Recurring work is an observable workflow. An agent may run a bounded part of that workflow through tools we approved. We stay accountable for the objective, the exceptions, the high-impact decisions, and the governance of the system.

Two attractive versions fail that test. The first says an AI-native company is one where everyone chats with a model all day. Chat is useful. A company cannot run on conversations that disappear. Repeated work needs a trigger, a schema, permissions, a durable record, an evaluation, a log, a way to fail, and an owner.

The second says an AI-native company runs itself. It does not. Frontier Firm research describes teams of people and agents. The NIST AI Risk Management Framework treats trustworthy AI as a responsibility that runs through design, development, deployment, use, and evaluation.

The work

Four kinds of work. One stays with us.

We use three levels as an analytical frame, not as an industry standard. The frame lines up Frontier Firm research, the Anthropic distinction between workflows and agents, and the NIST approach to risk.

An AI-enabled company drops a tool into the job it already has. An AI-first company treats models as a wide priority and retunes processes to exploit them. An AI-native company designs the work around machine execution from the start: events, workflows, agents, APIs, approvals, and service identities. Autonomy is tiered by risk and by whether a step can be undone. Knowledge is structured so a system can retrieve it and act. Quality is evaluations, policy checks, sampling, telemetry, and a path back to us.

Inside that company the work splits four ways. Deterministic work has known rules: synchronize a record, run the tests, raise an alert. Probabilistic work has a clear aim and a fuzzy reading: classify feedback, extract facts from a page, draft a paragraph, rank a lead. Agentic work chooses its own intermediate steps: investigate an unfamiliar failure, research a market, assemble a campaign. The Anthropic line is clean. Workflows follow a code path. Agents decide, as they go, how to use the tools they were given.

The fourth kind stays with us. Direction, taste, negotiation, accountability, and consequences do not move to the model.

The useful question is not whether AI can do marketing. It is which steps are deterministic, which need interpretation, which need open exploration, which can be reversed, which create legal, financial, brand, or privacy exposure, and what evidence shows the workflow is working.

A demo is not that evidence. In a field study of more than 5,000 customer-support workers, generative AI assistance improved productivity overall, with substantially larger gains for novice and lower-skilled workers than for the most experienced workers. Value depends on the task, the person, the workflow, and whether expert knowledge actually moves through the system.

Build order

Workflows first. Bots only where the path is open.

We do not invent a cast of named agents and then look for work. We start with a job we already repeat. We write it as a process we can watch. We add an agent only where the uncertainty requires a choice the code cannot make ahead of time.

The Anthropic account of production systems follows that order. Successful systems tended to use simple, composable patterns, rather than the most elaborate framework.

The default is the least agentic design that solves the problem. A workflow with fixed steps is the production pattern: we can test it, cost it, and predict it. A single tool-using agent fits a bounded task whose path is not known in advance. A lead agent with specialist agents fits work that is genuinely parallel and can be split. An open-ended agent that explores on its own stays out of critical operations.

The Anthropic research system is a warning against reaching for many agents because it looks advanced. On an internal, breadth-oriented research evaluation, an orchestrator-worker system outperformed a single agent by 90.2%. The write-up qualifies that figure as an internal eval: a lead agent on Claude Opus 4, with Claude Sonnet 4 subagents. The same account says multi-agent systems consume substantially more tokens, and that they fit poorly when agents must keep sharing state on a tightly coupled task. Parallel agents are an optimization for a shape of problem. They are not a house style.

Autonomy

A boundary, not a switch.

A system can classify a support ticket on its own and still be forbidden to refund past a threshold. It can open a pull request and still be forbidden to merge it. It can draft a public piece and still be forbidden to publish it. It can investigate an incident and still be forbidden to delete production data.

We draw the line from impact, from whether the step can be undone, and from how uncertain the judgment is. A clever agent that can delete customer data should have less room than a plain classifier whose worst miss is the wrong queue.

In a public memo in 2025, the chief executive of Shopify wrote that "reflexive AI usage" is now a baseline expectation. The memo also asks teams to show why AI cannot do the work before they ask for more people or resources. The cultural signal is real. The score is not. Usage is an input. The question we care about is which system delivers the outcome at a cost and a risk we accept. Sometimes that system is an agent. Sometimes it is ordinary code. Sometimes it is a better query. Sometimes it is one of us.

The layer

One layer for six products.

A model is not the company. It is a replaceable reasoning part inside a controlled system. The durable pieces sit underneath: systems of record, APIs, identity, permissions, workflow state, tests, and observability.

We build AutoReal, Vitrinsel, Atolye, guno, Lexicon, and Olina. The leverage, while the studio is small, is one shared layer: identity, tool access, model routing, telemetry, evaluations, secrets, approvals, and skills we can reuse. Six separate stacks would rebuild that layer six times. This is a goal for how we operate. It is not a claim that the layer is finished.

A few rules are not optional. Every recurring workflow has an owner. A machine can run the work. It cannot hold the accountability. Every agent that can write has its own identity. "The model did it" is not an audit trail. Every important workflow has an evaluation. If we cannot say what a good outcome is, autonomy is early. Every action that cannot be undone has an escalation rule. Every agent action can be traced.

OpenTelemetry gives vendor-neutral primitives for traces, metrics, and logs. A trace of a run should show which model ran, what context it saw, which tools it called, what changed, what it cost, whether the result was right, and who approved it. The NIST Generative AI Profile frames trustworthiness as something to build in through design, development, use, and evaluation, not as a coat of paint after deployment.

The OWASP GenAI project 2026 list of leading risks is based on risks seen in real applications. We treat pages, mail, and uploaded files as hostile input. An agent can turn a prompt injection into a tool call. Secrets stay out of prompts. A read and a write are different tools. If we serve people covered by EU law, the GDPR and the AI Act can apply, depending on the processing and the use. The Act entered into force in 2024 and became generally applicable on 2 August 2026, with some provisions applying earlier.

When the same miss is corrected twice, that correction should become infrastructure: a test, an instruction, a policy, or a change to the workflow. That is where a system starts to compound. It is a practice we are aiming at, not a result we are reporting.

The measure

Not usage. The share of work that can run.

The outcome is the share of recurring work that runs through workflows we manage, evaluate, and observe, at a cost that makes sense, with an owner named before the run. How often someone opens a chat window is an input. The Shopify memo is a useful pressure and a bad scoreboard.

A count of merged pull requests is a poor primary measure for the same reason. An engineering system with agents in it can produce many small changes cheaply. In the thirty days from September 11, 2026 through October 10, 2026, the Lab recorded 216 merged pull requests. That number is a snapshot of that window. Check it against the Lab again before treating it as the current count. Better measures are the time from an idea to a validated outcome, the quality of what shipped, defects that escaped, how often we roll back, and how much review the change still needs.

The targets below are goals. They are not results we have posted.

We want 70 to 85 percent of eligible recurring workflows to run through managed systems. We want every managed workflow that writes to be traceable, so the run can be reconstructed. We do not want the escalation rate driven to zero. An escalation can be a boundary we placed on purpose. The goal is fewer needless stops, with the intentional approvals left in place.

Outside cases

Experiments. Not templates.

Outside cases are design experiments, not templates. Klarna reported that the customer-service assistant handled 2.3 million conversations in its first month, about two-thirds of those chats. High-volume, repetitive service work can be a strong candidate when the outcome and the escalation route are measurable. We would not copy that result onto every kind of knowledge work, or remove the path back to a person. The OpenAI account of Dose ID, a pilot at Moderna, describes a data analysis assistant that supports the clinical study team while the team leads the review and the dose decision. We keep that second half, and we do not treat a count of bots as a score. OpenAI also reported, in September 2026, that coding agents had become part of daily research work, with people still setting research priorities, judging which ideas and results to pursue, and deciding whether to scale, pause, or deploy. That is the split we want. The system carries execution. We keep judgment.

We started in 2026. The portfolio is already wide: guno in the morning, Lexicon and Olina beside it, and AutoReal, Vitrinsel, and Atolye for businesses. The rule we use on a product applies to the studio. Start from the repeated job. Give the repeating part to the system. Keep the direction. The bottleneck that remains is judgment.

Sources

What we did not invent. Linked.

Claims that are not ours are linked below. The percentages in the measure section are goals, not results we have recorded. The pull request count is a dated snapshot.