Engineering brief
Flywire's Orbit: Workflows, Not Autopilot, Is the Real Agent Pattern
At a glance
The brief is enough
- Relevance
- Practical value
- Radar
- Time horizon
- Now
- Warnings
- None
Flywire put LLMs inside deterministic YAML workflows, ran 11,000 executions in 30 days, and still kept humans on every merge request. The pattern is credible; the 99% success rate deserves skepticism until quality, not just completion, is measured.
A production blueprint for agent automation that keeps control, compliance, and humans in the loop instead of chasing autonomous agents.
Watch if you are designing an internal agent platform for a regulated enterprise and want a concrete production reference.
Summary
The concrete signal. Flywire, a payments company with roughly 400 engineers under PCI DSS and SOC 2, spent six months building Orbit: an internal platform for agents that don't run free. Every workflow is YAML, reviewed like code, and mixes deterministic steps with small LLM calls. In 30 days, Orbit logged 11,000 executions, including 9,700 code reviews averaging under three minutes per merge request.
The architecture bet. The team rejected open-ended agent loops. Code handles predictable parts; the model is called only where reasoning is needed, under strict JSON schemas and guardrails. Each LLM step declares its own model, and each restricts network access, tools, skills, and MCP servers. Orbit reuses the Claude Agent SDK and separates orchestration, runtime, and session state on AWS Fargate. The architecture is deliberately boring, which is why it can pass compliance review.
The governance model. Each workflow is a single YAML file in a repository, going through the same merge request process as any code. A code review agent is triggered by a GitLab webhook, fetches metadata, classifies risk, clones the repo read-only, calls the model, and posts findings. Entry points include APIs, CLI, webhooks from GitLab, Jira, Sentry, and AWS, plus scheduled jobs, with an MCP server on the way. Everything is traceable with OpenTelemetry; merge request remains the human checkpoint.
The metric gap. Flywire reports a 99% success rate across 11,000 executions, plus 159 dependency-fix merge requests and 413 lint fixes. Those numbers prove operational stability and team comfort, not output correctness. A code review bot can complete reliably while producing marginal comments. Without online evaluations, quality checks still rely on golden datasets from production traces.
The trade-offs. Building in-house made sense because sensitive payment data stays inside Victoria, Flywire's internal PaaS, and avoids long vendor security reviews. That choice has costs: the platform team must keep pace with roughly one Claude Code release per day and over 20 new models in six months. Container limits intentionally exclude package managers, so agents like the ticket-to-MR implementer cannot run native builds or tests yet. Full sandboxing, resumable sessions, and a cost-aware model router are on the roadmap.
The larger lesson. Flywire recommends starting with a skill, then promoting it to a workflow once it proves valuable. That is a useful adoption path for any engineering organization: cheap experiments first, governed automation second. The team's biggest insight is that agent platforms are not about model capability. They are about control, cost, and workflow design. For leaders, this is a credible template for moving from isolated AI experiments to something an engineering organization can run in a regulated environment.
My take
I like the workflow-first bet. It treats an LLM as a fallible component inside a system a team already knows how to review and operate, and that is the right default for a regulated enterprise. Most teams should copy that pattern before they copy the autonomy talk.
I would be more careful with the metrics. A 99% completion rate across 11,000 runs says the harness is stable, not that the output is correct, and a code review agent can finish reliably while producing low-value comments. The bigger open question is whether a dedicated platform team is the prerequisite. For most organizations, starting with one workflow, one YAML file, and a human review loop is cheaper than building an Orbit.
What to do with this
- Pick one repetitive task and define it as a YAML workflow with deterministic steps and a single LLM step.
- Ask your platform team for guardrails: timeouts, rate limits, concurrency locks, and per-step network or tool restrictions.
- Instrument every agent execution with OpenTelemetry and build a golden dataset from real traces before changing prompts or models.
Watch the video
This video is blocked due to your privacy settings. To watch this video, please accept YouTube marketing cookies.
Related breakdowns
Bounded AI Judgment Is the Compliant Workflow Pattern
Why compliant AI workflows need deterministic control flow and gated model judgment. The open question: can labeled human confirmations really shrink…
Universal data schemas are dead. Build ontologies at decision time.
Cheap intelligence makes data transformation nearly free, but universal schemas still fail. Build ontologies when decisions happen; don't trust model priors.
Stop Fine-Tuning Your Way Out of Bad Retrieval
Stop fine-tuning to fix retrieval problems. Use prompt for behavior, memory for facts, weights for stable patterns. Here's how to avoid the accidental…
Get TL;DW
Too Long; Didn't Watch.
A concise breakdowns of the AI and devtools videos that actually matter for engineering leaders.
Free. Weekly. No hype.
Video and thumbnails remain the property of their respective creators. tldw.news provides editorial analysis, commentary, and discovery links to original content.