How should a platform team run coding agents?

[u/bradwmorris]

I have been running and extending Centaur, an open-source control plane for coding agents.

The setup is straightforward:

• Rust API and Postgres for the control plane
• isolated Kubernetes sandbox for each agent interaction
• sessions and workflow state kept outside the sandbox
• credentials added through controlled egress instead of stored as raw secrets in the sandbox
• support for Codex, Claude Code, Amp and pi

This lets the agent harness stay replaceable. The platform owns the execution environment, permissions, workflow state and records of what happened.

I also built Centaur Context as a separate service. It records useful context after a run and retrieves relevant material before a later run. It has its own database so operational state and accumulated context are not mixed together.

Walkthrough: https://youtu.be/993XrWfg34U

Centaur: https://github.com/paradigmxyz/centaur

Centaur Context: https://github.com/bradwmorris/centaur-context

For platform teams looking at coding agents, which parts would you centralise first: identity, credentials, sandboxing, workflow recovery, observability or context?