The site you are reading is maintained by a small fleet of AI agents. One audits search visibility and opens pull requests. One reviews every piece of content for things that should never be published. None of them can ship anything on their own.

That last sentence is the whole design. An agent that can write is easy to build in 2026. An agent you can leave running for a month without it costing you money, reputation or a production outage is an engineering problem — and mostly not a model problem.

Here is how I set that up, and why the infrastructure underneath is deliberately cheap.

1. One Agent, One Job

The first instinct with agents is to build one clever generalist and give it every tool. It demos well and fails in ways nobody can debug, because when something goes wrong you cannot tell which of its ten responsibilities produced the mistake.

So every agent in the fleet has a narrow role and a written brief:

  • An SEO agent audits pages, fixes the mechanical parts — meta tags, structured data, sitemaps — and proposes copy changes rather than making them.
  • A content security guard reads every draft for things that must not go public: client details, personal data, anything that would be a confidentiality problem later.
  • Scheduled monitors check the live site’s health and raise an issue when something drifts, instead of silently “fixing” it.

Narrow roles make failures legible. If a meta description is wrong, there is exactly one agent to look at, one brief to correct, and one history of what it did.

2. Contracts, Not Vibes

Agents do not talk to each other in free text. Work arrives as an issue with a defined scope, results leave as a pull request or a structured comment, and tools are exposed through explicit interfaces — MCP servers, validated inputs and outputs — rather than “here is a shell, good luck”.

That buys two things. A human can read every handoff after the fact. And a bad output fails at a boundary, where it is cheap to catch, instead of three steps later where it is expensive.

3. Gates That Machines Cannot Talk Their Way Past

Prompts are advice. Gates are enforcement. The fleet runs behind three of them:

  1. Build-time checks. Every change goes through the same build as a human’s would, including a script that refuses to publish wording on a banned list and a script that verifies titles, canonicals and structured data. An agent can argue with a reviewer; it cannot argue with a failing exit code.
  2. Isolated workspaces. Agents work on their own branches and never push to main. The worst a confused agent can produce is a pull request someone closes.
  3. Human sign-off for anything public. Merging, publishing and anything touching an external account needs an explicit yes from a person, per item. That rule exists because the cost of an agent being confidently wrong in public is much higher than the cost of waiting a day.

The same pattern applies to data jobs: a source that returns anomalies several runs in a row switches itself off and raises an alert rather than hammering an endpoint that is not answering.

4. The Ingestion Ladder: Sanctioned Sources First

The same thinking shapes how data comes in. The tempting default is to treat every source the same way and pay the heaviest price for all of them. Instead, each source climbs a ladder and stops at the first rung that works:

  1. Official APIs first. Where a platform publishes an API, it is the cheapest, most stable and most sanctioned access there is.
  2. Partner and licensed feeds second. Where no public API exists, a data partnership beats anything built in-house on cost, freshness and legal footing.
  3. Circuit breakers per source. A source that keeps failing takes itself out of the run instead of burning budget on retries.
  4. A manual review queue last. What no sanctioned channel covers goes to a person, not to a more expensive robot.

Every step runs within the source’s terms and published rate limits. That is not a compliance footnote; it is what keeps the pipeline boring enough to run unattended.

5. A Boring PostgreSQL Core

Agents and pipelines both need a place where state lives, and that place does not need to be exotic. Teams with modest traffic regularly pay for managed streaming clusters and data warehouses that sit mostly idle.

In the systems I own, event logs, price feeds and audit trails live in PostgreSQL on ordinary dedicated nodes. The goal is not to avoid scale. It is to avoid paying for scale you are not using. Three techniques do most of the work:

  • BRIN indexes for append-only tables ordered by time. A BRIN index stores the min and max per block range instead of an entry per row, so it stays small enough to live in memory.
  • Declarative monthly partitioning. Queries touch only the partitions they need, and retiring old data is a DROP TABLE instead of a slow, lock-heavy DELETE.
  • Batched writes with COPY. Rows are buffered and flushed in batches, with ON CONFLICT DO UPDATE keeping reruns idempotent.

How far one tuned node goes depends on the workload, the schema and the hardware — which is why the answer comes from a benchmark, not from a diagram.

6. Where the Money Actually Goes

Orchestration is where AI systems quietly become expensive. Every agent run costs tokens, every retry costs tokens again, and a loop without a budget will happily spend all night rediscovering the same failure.

So cost is part of the design, not a report at the end of the month:

  • Cheapest capable model per task. Routine checks do not need the biggest model; judgement calls might.
  • Runs are scoped. An agent gets a specific issue, not an open-ended mandate to “improve things”.
  • State lives in the database, not in the conversation. A restarted job resumes from a record instead of re-reading everything it already processed.

None of this is glamorous. That is the point. The fleet is useful because it is predictable, and it is predictable because the interesting decisions — what to publish, what to merge, what to spend — still belong to a person.

If you are building agent systems, spend less time on how clever each agent is and more on the rails around it: narrow roles, explicit contracts, gates that fail loudly, and a human where the stakes are public.

✱