Pilot to production

Build with AI — inside your policy.

Your team sets the harness once. Anyone builds with any tool. Nothing ships without review.

For IT: see the harness model For builders: start free with your agent Talk to an engineer →

The harness, enumerated

What your team mandates before anyone builds:

Approved AI skills

The skills agents are allowed to build with

The test suite

What every build must pass

Allowed dependencies

The code that's permitted in

Auth patterns & identity

How access works, every time

Environments & residency

Where things run and data lives

Agent rules

Standing instructions agents inherit

Inherited automatically by every workspace. Specificity is the point: this list is what convinces the technical reader.

Enforced in the request path, not in a PDF.

Policy here isn't documentation. Middleware enforces it on every request — before input validation and before the response leaves — assigned at the workspace level so no endpoint can skip it. Sensitive fields: encrypted in and out, no matter who built the endpoint.

The flow

Builder connects any agent (Claude, Cursor, Codex) via the Xano MCP → the agent scaffolds against the harness by default → sandbox → deploy-to-stage creates an immutable release → IT inspects and promotes the exact artifact to production.

[Flow diagram: agent → harness → sandbox → immutable release → review → production]

Why agents do better work here

Your rules, docs, and skills are standing context; agents build within them instead of re-prompting and hoping. And the output is visible: readable by the person who has to approve it.

Claude Code, with and without the harness

Same agent. Different software.

Claude Code alone.

The harness is one developer's markdown files: advisory rules the agent can drift from, different in every repo.
Context gets re-prompted every session.
The output deploys anywhere; the only person who can vouch for it is the person who prompted it.
Review means reading a wall of generated code after the fact.

Claude Code on Xano.

The same agent connects through the Xano MCP and inherits your organization's harness: specs, agent rules, skills, docs, and business rules as standing context.
It scaffolds against approved auth patterns, dependencies, and environments by default.
Builds land in a sandbox, ship as an immutable release, and pass your review gate before promotion.
Enforced per environment and per tenant.

The difference isn't the agent. A personal harness makes one developer faster. An organizational harness makes the work trustworthy to everyone who didn't write it.

[Visual: the with/without contrast slide from the Xano 2026 deck]

Let a thousand flowers bloom, in the greenhouse

Most experiments stay small, and every one of them runs through a governed space. The one that matters takes the same path to production as everything else — no rewrite, no re-platforming.

"I'm building it through Xano because when I hit the lotto ticket, I can take it all the way."

Proof: the BNP Paribas pattern (hackathon → governed pilot → production) · the UNDP CRM replica, built in about two days.