IN PLAIN TERMS
Running a dozen websites and pipelines alone means the routine work never ends: audits, security checks, deploy verification, credential rotation. So I built a staff department out of AI agents. Nineteen specialists do the recurring work, guardrails inspect everything they touch for leaked credentials and unsafe pushes, and nothing gets to call itself done without evidence.
The situation
By 2026 I was running a dozen live properties solo: marketing sites, a lead-gen product, reporting pipelines, client deliverables. Each one accumulates recurring obligations. Audit the SEO, review the code, verify the deploys, rotate the keys, check the pipelines, brief the morning. Every task is routine, and together they consume the exact hours that building requires.
My job
Get the recurring work done to a professional standard without hiring, and without letting it eat the calendar. The bar was not "automated". The bar was trustworthy enough that I act on the output without redoing the work.
What I built
- →Nineteen specialized agents, each with one narrow job and its own instructions, organized like a department: a six-agent website audit team, a seven-agent security red team, a five-agent hardening blue team, and a code reviewer
- →Thirty-two operational skills for the repeatable workflows: morning briefings, end-of-session safety checks, credential rotation with downstream validation, deploy audits, and clean handoffs between working sessions
- →Guardrail hooks that run on every action, listed below
- →All of it versioned in git and managed like a product: documented, tested, continuously improved with Claude Code as the platform
The org-chart instinct comes from managing real teams: up to 13 people across search, social, and analytics. Agents are cheaper to coach and never burn out, but the design problem is identical: narrow roles, clear handoffs, and verification at the seams. If you know Zapier, n8n, or Gumloop, this is that pattern taken further, with version control, tests, and guardrails.
$ ls agents/ a11y-agent cro-agent logic-agent secrets-mgmt-agent ai-redteam-agent data-exposure-agent monitoring-agent security-agent auth-agent hardening-agent pagespeed-agent seo-agent code-review-agent infra-agent patch-agent validation-agent content-seo-agent injection-agent recon-agent
19 specialists. Each owns one dimension: finding problems, proving them, or fixing them.
What one audit run looks like
One command fans the audit team out in parallel. Each agent inspects a single dimension of the site, findings come back as one consolidated table ordered by severity, and every claim carries the file and line it points to.
$ claude /website-audit https://casevalue.law TIER 1: FIX NOW (ordered by severity x effort) [seo] head race ships the wrong <head> on all 816 state pages [security] firm-signup: unauthenticated overwrite of partner records [security] process-lead: back-compat branch is an open email relay [seo] site-wide soft 404: every unknown URL returns 200 [content] 816-page tier fails the repo's own duplication gate [a11y] questionnaire auto-advance is keyboard-unusable 11 tier-1 findings -> docs/audits/website-audit-2026-07-28.md every finding cites the exact file and line it points to
Condensed from the real audit table on my own lead-gen product. Six agents ran in parallel; each finding is shown with its reporting agent.
How the guardrails work
The guardrails assume the operator and the agents will both make mistakes eventually.
The results
19
specialized agents in the fleet
32
operational skills for repeat workflows
2
critical vulns caught in production
patched + re-verified same day
≈10 HRS
of recurring ops reclaimed weekly
audits, briefings, health checks
- →The audit above surfaced two critical security vulnerabilities in production serverless functions; findings ship as plain-language tables with file-and-line evidence a non-technical partner can act on, and both criticals were patched and re-verified live the same day
- →Weekly audits, daily briefings, and health monitoring run without occupying working hours
- →Report numbers pass a claim-verification skill that checks them against source APIs before a stakeholder sees them
- →Extending the fleet to a new property is configuration, not construction
Inside a marketing org, this pattern has a name: AI enablement with governance. The same fleet approach builds the campaign-QA, content-review, and reporting agents a team can actually trust, because the trust is engineered in rather than promised.