A software factory extends DevOps by assigning production work to AI agents while preserving the pipeline controls, review gates, and observability systems that DevOps established for human-led delivery.
TL;DR
DevOps organized handoffs between human developers and operations. A software factory changes who performs the labor inside the pipeline: AI agents handle production work from intake to ship, while humans supervise at defined exception points. CI/CD, testing, review gates, and deployment controls continue governing agent output under risk-tiered human oversight.
Engineering leaders searching "software factory vs devops" usually want to know whether the two models compete. They do not. DevOps built the delivery infrastructure; a software factory changes who operates inside it. The distinction matters because organizations scaling agentic development need to know which controls carry over and which assumptions break when agents generate most production code.
Two evidence sources frame this comparison. The 2025 DORA report, based on roughly 5,000 respondents, examined how AI adoption relates to software delivery throughput and stability. DORA's platform-engineering guidance covers downstream handoffs, including testing, security reviews, and deployment processes that both models share.
DevOps Delivery Foundations for Human Teams
DevOps reorganized the flow of human work between development and operations. In 2009, John Allspaw and Paul Hammond presented "10+ Deploys Per Day" at Velocity, showing Flickr completing at least 10 deployments daily. Patrick Debois coined the term at the first DevOpsDays in Ghent. The structural problem: developers were incentivized to ship features, operators were incentivized to protect stability, and work bounced between them.
The frameworks that followed organize coordination among human teams. Gene Kim's Three Ways define flow and systems thinking, amplified feedback loops, and a culture of continual experimentation. The CALMS model (Culture, Automation, Lean, Measurement, Sharing) codified the operational principles. Staged deployment pipelines formalized continuous delivery.
DORA gave the movement its measurement system. In 2024, DORA restructured the metrics around two outcomes: software delivery throughput and software delivery instability. Throughput includes change lead time, deployment frequency, and failed deployment recovery time. Instability includes change fail rate and deployment rework rate, which DORA added in 2024. These metrics describe team-level delivery outcomes, while agent output requires separate measures. Teams can track these signals alongside broader engineering velocity metrics.
DORA's delivery research evaluates batch size and feedback against its two measured delivery outcomes.
The Software Factory in the Agent Era
In the 2025-2026 agentic sense, a software factory uses fleets of AI agents in a feedback loop to turn bug reports, specs, and customer feedback into deployed, verified software. A formal agentic-engineering framework describes this as a multi-agent coordination model in which agents have defined roles, shared memory, and unified observability across the delivery pipeline.
The term carries older meanings worth separating. The U.S. Department of Defense still uses it today, and its DevSecOps Reference Design defines a software factory as "a software assembly plant that contains multiple pipelines... to produce a set of software deployable artifacts with minimal human intervention."
In the DoD version, developers operate a pipeline-centric factory. The agentic version assigns the production labor to agents. In February 2026, StrongDM's AI team published a manifesto describing a software factory where coding agents write, test, and ship production software while humans design specifications, curate test scenarios, and observe outcomes. A Stanford CodeX analysis noted that StrongDM's charter contains two governing rules: no human-written code and no human-reviewed code.
A corpus study of 50 production loop specifications found that human approval gates concentrate at destructive actions: production deployments, financial transactions, and external communications. Most verification runs autonomously, with human checkpoints reserved for high-risk transitions. Cosmos follows the same pattern, placing human checkpoints where destructive actions concentrate rather than gating every step.
Key Differences Between DevOps and a Software Factory
DevOps and a software factory share the same pipeline infrastructure but differ across eight delivery dimensions, from who does the work to which failure modes the team must handle. No single published source presents this comparison head-to-head; the table below synthesizes DORA research, arXiv studies, and practitioner data from 2024-2026.
| Dimension | DevOps (human labor) | Software factory (agent labor) |
|---|---|---|
| Unit of labor | Human engineer completes a task or PR | Agent completes a task, with humans assigned to review |
| Pipeline role | Humans perform work through CI/CD | CI/CD, testing, and observability control agent output |
| Downstream constraints | Review queues and approval chains | Five constraints: specification quality, execution context, verification, traceability, and controlled iteration |
| Quality gates | Human review plus automated CI checks | Risk-tiered gates addressing agent failure profiles, including syntactically plausible code with semantic errors |
| Feedback loops | Sprint retros, post-mortems, and human learning | Agents operate the loops but do not retain lessons; humans route insights back into context and specs |
| Metrics | Four classic DORA metrics | Five DORA metrics including rework rate; DORA renamed its report to "State of AI-Assisted Software Development" |
| Team topology | Cross-functional eight-person human teams | Human teams supervise agent fleets |
| Failure modes | Broken builds, config drift, human error | Non-deterministic agent failures: misread intent, prompt injection, wrong tool selection, correct syntax with wrong behavior |
The table draws on specific research for each dimension. An agent-authored PR analysis documents how human review responsibilities shift when agents handle implementation. Martin Fowler observes that agents do not carry lessons between runs, leaving humans to route corrections back into specs and context. DORA's 2025 year-in-review added deployment rework rate as a fifth metric, and a study of non-deterministic agent failures categorizes the failure modes specific to agent-authored code.
Two rows deserve further expansion. On quality gates, an AI code analysis categorizes the failure profile of AI-generated code across semantic inaccuracies, hidden security vulnerabilities, and misalignment with implicit system constraints. These failure profiles require agent quality frameworks that go beyond surface-level syntax checks.
On failure modes, Martin Fowler calls the "Lethal Trifecta" an agent that combines access to private data, exposure to untrusted content, and a way to communicate externally.
Software Factories Build on DevOps
A software factory does not replace DevOps; organizations run agent workflows through the internal platforms and delivery controls that DevOps establishes. An agentic engineering framework likewise describes agentic engineering as an expansion of software engineering, not a replacement.
DORA measures how AI adoption affects delivery throughput and stability. In DORA 2024, a 25% increase in AI adoption was associated with an estimated 1.5% decrease in delivery throughput and a 7.2% decrease in delivery stability. The same DORA report found that among its nearly 5,000 respondents, 90% of organizations had adopted at least one internal platform.
DORA's platform guidance supports this layered model: internal platforms remain the foundation for agentic workflows, and agents use that tooling to move their output through the governed delivery pipeline.
Charity Majors, Honeycomb's CTO, identifies traces, production tests, and production evaluations as DevOps controls essential for nondeterministic production code. She argues that nondeterministic code in production is forcing teams to adopt the instrumentation and production testing practices they should have built all along. The DORA 2024 results reinforce her point: weak testing, review, deployment, and platform controls constrain AI-assisted delivery, no matter how fast agents generate code.
The Bottleneck Shift From Authoring to Verification
In human-led delivery, the primary constraint is authoring speed: how fast engineers write, review, and iterate on code. When agents take over authoring, that constraint dissolves, and the bottleneck shifts downstream to verification, review, and specification quality. An agent workflow analysis identifies five downstream constraints that become binding: specification quality, execution context, verification, traceability, and controlled iteration.
DORA calls downstream auditing and review the verification tax.
Google describes a three-stage internal migration workflow in which an expert engineer identifies the migration target, an LLM-based toolkit generates and validates changes, and the engineer manually reviews the result. Its AI-assisted migration paper identifies code review and change rollout as stages that require a human operator.
GitHub's Copilot cloud agent requires another reviewer to approve its PR before merge. Augment Cosmos, a unified cloud agents platform, retains a similar review gate, coordinating agent work and human checkpoints across the delivery lifecycle.
Human Oversight in a Software Factory
Humans supervise production at exception points by writing specs, setting policy, reviewing at risk-weighted gates, and taking accountability for work they did not personally write. An agent-authored PR analysis of 4,550 agent-authored PRs documents monitoring and debugging agent actions as human responsibilities. A second agentic-engineering framework describes the human role as specifying what to do and verifying what was done.
Team structure changes accordingly as human teams supervise expanding agent fleets. Measurement must follow the same shift. Teams should track commit volume and PR counts alongside outcome measures such as feature completion, change failure rate, lead time, and deployment rework rate. Delivery outcomes, rather than volume, should remain the target.
Agent supervision adds design constraints beyond conventional human-operated workflows. Approval gates must live in the workflow execution layer because prompt injection can influence an agent's authorization decisions.
Trust prerequisites must exist before autonomy. Team Topologies' second edition lists five for trusting groups of AI agents:
- Clear domain boundaries
- Constrained operating contexts
- Explainable decisions
- Audit trails
- High-fidelity telemetry
In Cosmos, teams configure these boundaries through three auditable primitives:
- Environments define where agents run
- Experts define their tools and behavior
- Sessions capture workflows for replay and reuse
Audit Your Review Capacity Before You Scale Agent Output
DORA's 2024 delivery data shows that higher AI adoption can expose constraints in throughput and stability. Three measurements expose whether review capacity will hold as agent output scales:
- PR review pickup time: how long a PR sits before a human opens it
- Unreviewed merge rate: the percentage of PRs merging without human review
- Agent-to-reviewer ratio: agent-authored changes per available reviewer per sprint
If pickup time is climbing or unreviewed merges are rising, adding more agent capacity will compound the problem. Set risk-tiered gates before expanding the fleet:
- Low-risk changes: automated checks only
- Standard work: single-reviewer gate
- High-blast-radius changes: multi-reviewer gate
DevOps built the delivery infrastructure. A software factory changes who does the work inside it. Scaling agent output without matching review, verification, and governance capacity creates the bottleneck the factory was supposed to eliminate.
Frequently Asked Questions About Software Factories and DevOps
These are the questions engineering leaders and platform teams ask when evaluating how software factory models relate to their existing DevOps practices.
Related Guides
Written by
Paula Hingel
Paula writes about the patterns that make AI coding agents actually work — spec-driven development, multi-agent orchestration, and the context engineering layer most teams skip. Her guides draw on real build examples and focus on what changes when you move from a single AI assistant to a full agentic codebase.