Skip to content

The Atelier and the Factory

Foundation · The atelier and the factory

This chapter extends: Software Factory Definition. Scope: the steelmanned case that AI and flat orgs have dissolved the professional software factory, from vibe coding to the artist colony, and why SF² plus Coadaptive Security answers the movement rather than any single voice.

Not everyone who builds software believes they work in a factory, and the ranks of the unbelievers are growing. One current says the tools have democratized creation: describe what you want to an AI and working software falls out, so building value no longer belongs to professional engineers. An older current says the org was always the wrong picture, that titles and reporting lines are scaffolding the work does not need. Shyam Sankar, Palantir's CTO, gives the second its sharpest form, calling software production an artist colony where position and portfolio decouple and the artist and the work are the only durable units. The two currents arrive at the same verdict: the software factory is a dead metaphor. A framework called Software Factory Security owes that verdict a real answer rather than a dismissal. The answer is that both currents describe something true about the surface of the work, and both miss the factory that makes their version of it possible.

The case against the factory, steelmanned

The strongest version arrives in two registers. The first is about the tools. Andrej Karpathy, who named the practice vibe coding, argues that prompting your way to working software while you "forget that the code even exists" has opened building to anyone and released a wave of creativity. Jensen Huang tells audiences that everyone is a programmer now, that you just have to say something to the computer. Snowflake's Sridhar Ramaswamy describes salespeople who ship their own dashboards because all they do is describe what they want in English. The proof points are concrete: a British GP with no coding background built and shipped a working patient app for his clinic in four days, after agencies had quoted the job at £75,000. Replit's founder, Amjad Masad, frames that as the whole point, a platform he is building for a billion people rather than for professional engineers. The claim runs deeper than easier tooling. Taken to its limit, it is that producing software has stopped being a profession, a conclusion the movement points toward more than any single voice states outright.

The second register is about the shape of the org rather than the power of the tools, and Sankar states it most cleanly. In Position and Portfolio he argues that titles and org charts are scaffolding the work does not need: "There is only the artist and the work." Roles are fluid, ownership stays with the person who made the thing, and opportunity gets seized without waiting for a box on a chart to authorize it. He put it more plainly to the Financial Times in 2021: "We at Palantir, we're an artist colony, extraordinarily and exquisitely flat."

This is not generational posturing, and it names something real. A generation of engineers reads software as craft, where the person and the artifact are inseparable and the value lives in judgment rather than in process. Anyone who has watched one strong engineer outproduce a carefully managed team of ten has felt the pull of the argument. The atelier framing is a real cultural force, and a framework that pretends otherwise gets ignored by exactly the people it most needs to reach.

Why "Software Factory" is the right term anyway

The factory framing survives the critique because it answers a different question. The atelier describes how creative work feels and how talent arranges itself. The factory describes who is accountable when ten thousand deployments a day have to ship safely. Those are not competing claims about the same thing. The term names operational responsibility for delivery at scale, and that responsibility does not dissolve because the people doing the work think of themselves as artists. Someone still owns the blast radius when the artist's brilliant, unreviewed change reaches production.

Call the work a factory and the objection writes itself: an assembly line, the opposite of craft, the very image the democratized-creation crowd wants to leave behind. But a software factory optimizes something other than the throughput of identical parts: the time it takes for value to reach a customer, and for that customer's response to travel back to the people making it, so each version improves on the one before. The model for that is Toyota's line, where quality is built in at the source and anyone can pull the andon cord to halt production the instant a defect appears. Automate that discipline and the line catches its own defects while still answering to a human who can stop it, and the people it frees move up to deciding what to build while the machine handles how it ships.

That is what the democratization story gets right and stops short of. Describing software and delivering it are different acts, and the second one is the factory. The GP who shipped a patient app in four days never built a factory, but he ran on one: Replit carried the pipeline, the dependencies, the runtime, and the blast radius that four days of prompting could not. The wider building spreads, the more delivery rides on platforms like it. The factory outlived the org. It moved under the builder, into the platform.

This is the part the critique gets closest to and still misses. The org chart is not what makes someone responsible. But accountability follows the work to wherever the factory now runs, whether the org has flattened or the builder works alone. The GP still answers for patient data, and so does the platform underneath him. HIPAA does not care how many people were in the room. The AI era hands you a factory you did not build, and asks who owns it.

That platform is a real company with its own security function, often a better one than a lone builder could staff, and buying that function does not take the responsibility off the builder. A contract shifts a capped slice of the cost onto the platform and the duty to answer for what ships stays with whoever put the software in front of a user, the ground Third-Party stewardship already works.

The term is industrial-lineage vocabulary with a fifty-year paper trail.

Term provenance

The history predates the current debate by decades:

The Defense Department runs more than twenty accredited software factories right now. The word carries operational and regulatory weight in the one ecosystem where getting delivery wrong gets people killed. That is provenance rather than proof that every shop should think in factory terms; it shows the word is real and regulated where delivery is life-and-death. It is the right word for what SF² governs.

SF² + Coadaptive as the synthesis

Both framings are load-bearing, and the synthesis is naming the layer where each one holds.

The factory framing is right at the layer of operational accountability. Foundation and the Universal Security Conditions live here: who owns the supply chain, who answers for what runs in production, how delivery stays safe as it scales. The atelier framing, and the democratization argument with it, is right at the layer of the creative act and how roles get arranged inside a team. SF² never claimed that layer and does not want it. How you organize your artists is your business.

Coadaptive Security extends the picture to a third layer neither metaphor anticipated: the unit of operation in the AI era. That unit is most often a person working with agents, and it resembles a paired-intelligence cell more than a factory worker or a lone craftsman. Chapter 03, The Unit of Defense, takes that up. The synthesis names the layer at which each framing earns its keep, so no one has to choose between them.

The AI-era production-model question

The movement surfaces a harder question than the one it answers, and the synthesis has to sit with it honestly. If the unit of production is shifting from a team of humans to a human working with agents, neither metaphor maps. A factory is a human assembly line. An atelier is a lone craftsman with tools. A paired-intelligence cell is neither. The tools in this case reason, act, and occasionally get things wrong on their own initiative.

Foundation does not resolve that question. It names it and hands it forward to Coadaptive Security Chapter 03, where the unit of operation and the property that defends it get worked out.

See also