The genuinely astonishing thing about building software this year is the speed. An idea at breakfast can be a working app by dinner, with a real repo, sane structure, tests that pass, and a deploy that works. We’ve shipped several small tools this way. It still feels a little illegal.
Then you try to run the thing, and you meet the other half of the sentence nobody puts on the pricing page. Shipped and operated are different verbs, and the gap between them is where the whole year quietly goes.
Secrets are where the fantasy meets the floor
Here’s the moment the vibe breaks. Your weekend app needs an API key. The tutorial says put it in a .env file, which is fine for a tutorial and a small catastrophe waiting for a hobbyist who now has eight projects and a couple of automated agents all wanting credentials.
So you go looking for the grown-up solution, and you fall straight into a gap. On one side: paste the key in a file and hope. On the other: enterprise secret-management platforms, priced and shaped for companies with a security team to run them. There is a surprising amount of nothing in the middle, exactly where a solo builder or a two-person shop actually lives.
We ended up building our own small bridge: a way for our agents to pull scoped, read-only credentials from our password manager at runtime, so no human has to approve every single secret fetch by hand and no key gets pasted into a config file to be forgotten. It works. It also should not have been necessary. The tooling for building with AI has sprinted years ahead of the tooling for operating it safely, and that gap yawns widest precisely where the resources are thinnest. The people most encouraged to build with agents are the people with the least support for running them.
Build fast anyway; just keep honest score. “Look how fast I built it” and “I can run this without wincing” are two different achievements, and only one of them demos well.
The autonomous assistant that needed a babysitter
The other broken promise is agentic management. The pitch is seductive: an autonomous assistant that runs your errands, triages your inbox, manages the boring operational tail so you don’t have to. We built one. For a while we tended it more than it tended us.
It could do impressive things, occasionally, when the wind was right. What it could not do was be left alone, and an assistant you can’t leave alone is a second job with a charming interface. Every autonomous action it took was one you then had to check, and checking took longer than doing. The autonomy was real; the management turned out to be me.
This is the exact failure mode, at hobby scale, that Gartner expects to cancel more than 40% of enterprise agentic AI projects by 2027: escalating cost, unclear value, and the slow realization that autonomy without trustworthy oversight just relocates the work. We felt it in a personal project with a budget of zero. A company feels it as a canceled program and a written-off quarter. Same gap, different number of zeros.
What we actually took from it
Three things, and they’re the same three whether you’re a hobbyist or a bank:
- Budget for the operating, not just the building. The demo answers “can this be built.” It never answers “can this be run,” and running it is the part that lasts.
- Secrets are the tell. How a tool handles credentials, at the scale you actually operate, tells you whether it was designed for a slide or for a Tuesday. If the answer is “paste it in a file,” you found the floor.
- Autonomy is only worth what your oversight is worth. An agent you have to double-check on every move hasn’t saved you the move. Give agents the small, bounded jobs where being wrong is cheap, and keep a human on the ones where it isn’t.
We keep building fast, because building fast is a genuine gift and we’re not going to pretend otherwise. We’ve just stopped mistaking the prototype for the product. The prototype was the easy part. It was always going to be.