--- title: "The platform team you didn't plan for: what running coding agents at scale actually looks like" slug: harness-platform-team-coding-agents date: 2026-04-23 excerpt: "Cloudflare just published the eleven-month story of rolling AI coding agents to 60% of the company. The most useful detail is not the tech. It is which team ended up owning the work, and why every other engineering org is quietly heading toward the same answer." featured_image: "https://bbtxujdxvidaghmhxkqs.supabase.co/storage/v1/object/public/generated-images/blog-1776924953460-harness-platform-team-coding-agents.webp" canonical_url: https://cerevisor.com/blog/harness-platform-team-coding-agents updated_at: 2026-04-23T06:15:57.120214+00:00 --- # The platform team you didn't plan for: what running coding agents at scale actually looks like TLDR Cloudflare just published the inside story of rolling Claude Code, Cursor, and a stack of internal MCP servers to 60% of the company. The most useful detail is not the technology. It is that the team now running it was not new, and the engineering orgs scaling agents past pilot are quietly handing this work to whoever already owns CI and devex, not to a freshly minted AI Center of Excellence. ## The setup A long Cloudflare engineering post landed on Monday with a number I had not seen anywhere else this week. 3,683 active internal users on AI coding tools. 60% of the company. 93% of R&D. Not a survey, not a vendor case study. Their own internal telemetry, eleven months in. The reason I am writing about it on a Thursday: the more interesting detail is buried halfway down. The team that runs the entire AI engineering stack at Cloudflare today is not a new team. It is the existing Dev [Productivity](/blog/opus-4-7-first-week-productivity-check) team, the same group that already owned CI/CD, build systems, and internal automation. The tiger team that built the thing has already dissolved. I have been watching engineering leaders try to figure out who runs [coding agents](/blog/senior-engineer-adoption-myth) inside their org for about six months now. Nobody agrees. Some are spinning up “AI platform” pods. Some are putting it under security. Some are leaving it as a hobby project for a senior engineer who got excited. Cloudflare just gave us the cleanest data point yet on what one well-organized version of this looks like. ## What they actually tried Eleven months ago they pulled volunteers from across the company into a tiger team. The full name, which I love because it is so unromantic, is iMARS: Internal MCP Agent/Server Rollout Squad. From the post itself: > "Eleven months ago, we undertook a major project: to truly integrate AI into our engineering stack. We pulled together engineers from across the company to form a tiger team called iMARS (Internal MCP Agent/Server Rollout Squad). In the last 30 days, 3,683 internal users (60% company-wide, 93% across R&D) have actively used AI coding tools. 295 teams are currently utilizing agentic AI tools and coding assistants." Cloudflare Engineering Blog, April 2026 iMARS built three things in parallel. A platform layer for authentication, routing, and model inference. A knowledge layer that wires internal documentation and code into the agents. An enforcement layer for permissions, data loss prevention, and audit. Boring [infrastructure](/blog/series-b-ai-infrastructure-cost-reality) framing, on purpose. Nothing about prompts. Nothing about which IDE. Just the plumbing that has to exist before any of the IDE choices matter. Then, and this is the move I want to underline, the tiger team handed sustained ownership to the existing Dev Productivity team. The same engineering manager who ran CI/CD started running MCP servers. The same group that already shipped internal CLIs started shipping the AGENTS.md system. The work moved from “special project” to “boring tooling that needs to be on call.” InfoQ’s analysis of the same architecture, published two days later, named the underlying discipline. They called governance, observability, and policy enforcement a separate “control plane” concern in agent architectures. That framing matters. A control plane is not a feature. It is its own engineering practice with its own on-call rotation. 295 internal teams now running coding agents through the same control plane, all owned by one existing Dev Productivity group ## Where it works and where it breaks The model works because Dev Productivity teams already have the right reflexes. They think in golden paths. They run on-call rotations. They write internal documentation as part of the job, not as a heroic act. They have institutional skin in the game when something breaks at 2 a.m. Bolting MCP server operations onto that team is closer to “one more thing” than to “build a new culture from scratch.” It breaks in two predictable places. The first is when the AI work gets handed instead to a brand-new “AI Center of Excellence” or “AI Platform” pod with no operational history. I have seen four versions of this in the last quarter. The pattern is always the same. The new pod ships a v1 in eight weeks, gets a lot of internal applause, and then nobody is sure who owns the thing on a Tuesday morning when an MCP server starts hallucinating tool calls. By month nine the pod has either been absorbed into a real platform team or quietly disbanded. The second is when the work stays ambient. No team owns it. The senior engineer who set up the first internal MCP server is now the de facto operator of nine of them, none of which have a runbook. Cost, security, and reliability all degrade silently. This is the situation most 200-to-1000-person orgs are in right now and have not yet admitted. Key Insight The org-design choice that scales is not whether to create a new AI team. It is whether to absorb agent operations into the team that already runs developer tooling on call, before that team has had time to refuse the work. ## The pattern Three slots need explicit owners on day one of any serious [harness rollout](/blog/harness-supervisory-engineer-org-chart-box) past fifty engineers. Platform. The gateway, the auth model, the inference routing, the per-user spend cap. This is the layer that used to be “the IDE setup someone did once.” It is now its own product surface, and it has cost implications board-level enough that a finance partner needs visibility into the dashboard. Knowledge. The catalog of skills, instructions, AGENTS.md files, internal MCP servers, and the convention by which teams ship and version them. The reason every harness vendor is converging on a portable skills standard is that this layer was the wild west six months ago. Inside most orgs it still mostly is. Enforcement. The “lethal trifecta” check against private data, untrusted content, and external communication. The DLP rules. The audit trail security and compliance teams will need when something does eventually misfire. This is the work nobody volunteers for and everybody needs. > The org-design question is not whether to create an AI team. It is whether to absorb agent ops into the team that already runs CI on call before that team has had time to refuse the work. The Cloudflare path puts all three slots under one existing team. Uber’s path, which their Dev Platform leaders described publicly in March, splits across Dev Platform and Dev Experience but keeps both inside the same engineering organization with the same VP. Either works. What does not work is leaving any of the three slots without a name on it. --- ## What I would tell you over coffee Skip the internal debate about whether to create a new “AI team.” That debate eats six weeks and produces an org chart nobody likes. Walk down the hall to the engineering manager who already owns CI/CD and developer tooling, and have one short conversation. Tell them they are about to inherit MCP server operations, the agent skills catalog, and per-user spend telemetry, and they need a budget for one more headcount and a clear charter. Most of them will be relieved. They have been watching the work pile up in shadow form for months. Then write down who owns the three slots. Platform, knowledge, enforcement. One name each. Do that this week and you will be quietly ahead of every peer org I have looked at this month. #### Sources - [The AI engineering stack we built internally — on the platform we ship](https://blog.cloudflare.com/internal-ai-engineering-stack/) - Cloudflare Engineering Blog, 2026-04-20 - [Cloudflare Outlines MCP Architecture as Enterprises Confront Security and Governance Risks](https://www.infoq.com/news/2026/04/cloudflare-mcp/) - InfoQ, 2026-04-22