I left a portfolio CTO job at the start of 2025 to build again, this time with agents. Getting them to build the way I’d want a team to took a written operating framework. It’s called PANDO, it’s about two thousand lines, and it stays internal. The first project on it set the rule the rest is built on: a rule an agent might forget becomes a lint rule, a test, or a database policy. Every rule that can’t be broken names the code that enforces it, and nothing starts until that code is installed and seen catching a violation.

Every project starts from the same foundation, Next.js, Supabase, Prisma, and TypeScript, and every one can leave its host and run anywhere. Agents don’t choose the stack, so their attention goes to the domain.

Every database call runs inside a context that says who is asking. Without one, the call is refused. Each customer’s data is walled off twice, in the application and again in the database, and before anything ships a test tries to read across the wall and has to be refused.

Anything that touches money or compliance is decided by deterministic code the model can’t route around.

Every assistant I ship comes with the same harness as the home care assistant on the Work page.

Development agents fix selected backlog items on their own, behind gates. Payments, login, and the wall between customers sit outside those gates.

Each project ends with a report of where the framework was wrong, and the fixes go back in as rules with checks behind them.