Kevin and Phil: a production agent fleet for a six-brand design collective

The problem

A collective this size accumulates enormous knowledge: a 1,182-book physical library, 202 project case studies, six years of rate cards, 69 approved proposals, a 425-page slide library, a documented 27-tool strategy methodology. Knowing a thing existed required knowing who to ask. Writing in the right brand voice required a senior person's time. Pricing a proposal meant rebuilding a spreadsheet someone else had already built.

The constraint that shaped everything: six brands with genuinely different voices sharing one system means the primary risk is not "the AI is wrong." It is "the AI is wrong in the voice of the wrong brand, to a client." Brand isolation became hard rule number one, enforced structurally rather than by prompt suggestion.

What I built

Kevin runs the house. A retrieval-augmented knowledge system spanning ~1,192 library assets with shelf locations, 202 case studies and 57 external benchmarks, all answerable in natural language. Drafting in each brand's own register. A family of studio-deliverable skills that produce the documents the strategy studio actually ships: briefings, brand audits, leadership updates, insights reports, discovery reports. Two research tiers, image generation routed across two engines on cost logic, and per-user project memory that survives session resets. 42 skills at handover.

Kevin, live in Teams — asked what it can do, it answers with its actual scope, and declines everything outside it

"make it ppt so i can use it" — four minutes later, a real deck lands in the chat

Phil runs proposals end to end, on its own VM with its own identity because the data sensitivity is different. It estimates cost from six years of real rate cards, advises on pricing from 340 jobs distilled out of 92,000 timesheet rows, suggests case studies as proof, drafts in the studio's voice with a mandatory anti-AI-tell pass, and renders the approved proposal into the studio's real 20-slide deck, preserving its actual design. Validated by reproducing an approved client proposal's rates exactly. 13 skills.

The suite extends beyond chat. A vision pipeline reads technical production drawings, extracts dimensions and materials, and generates cost estimates in seconds, turning a multi-hour manual process into a reviewed-in-minutes one, with its reasoning shown so a human can verify every number.

Stuart, the finance agent, completes the suite: scoped from the start as its own machine and its own identity, because sensitive-domain bots stay structurally separate rather than permission-separated. It ships only when governance sign-off lands, a hard prerequisite rather than an obstacle to route around.

Architecture: trust is the product

• Brand isolation as law. One brand's material per task, and if the brand is ambiguous, the agent asks.
• Token discipline. The agent never scans folders. Navigation is index-first: a workspace map points to the one file the task needs. A stale index is a broken agent, so every deploy registers its files or they effectively do not exist.
• Two independent access axes. A four-tier permission ladder and a separate confidentiality clearance, both checked silently against a roster read live from disk, so a role change takes effect without a restart.
• Style, not template. A studio deliverable is a method that changes per project. Skills encode the invariant stance and derive structure from the project material. One skill was parked rather than built from a single example, because you cannot separate the invariant from the variable without seeing the range.
• Guaranteed side effects beat model-remembered steps. When archiving lived as prose in a skill file, the agent sometimes did not run it. The archive call moved into the generation code, where it cannot be forgotten.

The engineering underneath

The best stories are production failures diagnosed to root cause. An upstream framework bug permanently wedged user sessions with an invalid signature on every retry; it could not be fixed in someone else's code, so the goal changed from "the error never occurs" to "the error never matters": surgical repair tooling plus a five-minute self-healing watcher, six wedged sessions repaired live, invisible to users. The agent's own rules file had silently outgrown its injection limit and was dropping rules with no error; it was rewritten from 13,854 to 8,451 characters with every operative clause preserved. A registry defect had left 26 of 42 skills silently unregistered; a single-variable isolation test proved the cause without touching permissions for 100 users. And a proposal renderer produced Lorem ipsum that was not in the file: it was inherited placeholder text from the slide layouts, invisible to the document API, caught only because verification became render-to-PDF-and-grep.

The same discipline applied to data isolation: I identified a structural cross-user gap in the platform's shared media handling, built forensic tooling to scope and contain it, and shipped a tested two-layer isolation model designed so its failure mode is provably safe. It cannot fail into a leak, only into "file not copied."

The outcome

Both agents live in production with automated self-healing, nightly maintenance, code-enforced archiving to SharePoint, and a documented handover practice: thirteen structured records covering decisions, rollback paths, ruled-out hypotheses and open items, so any new engineer can operate the system from the documents alone.

What I learned

What you tell the model is not what the system does. Every lesson in this project orbits that insight: rules can silently truncate, skills can silently fail to register, prose instructions can silently not run. The engineering that matters is making the critical path independent of the model's memory, and making every failure mode visible, recoverable, or provably safe.