One Blast Radius: Why We Rebuilt Our AI as Many Small Workers

We judge a build by two questions: can you verify it, and can you contain it when it fails? The AI that runs our back office failed both when it was one big program — one worker that read the data, moved the money, sent the mail, and wrote the drafts. It worked, which was the problem. So we tore it down and rebuilt it as a couple dozen small workers, each doing one job. Here is the discipline behind that call.

One program that can do everything, can do everything

A monolith is a single blast radius. One bug, one leaked key, one confused model, and the thing that publishes a blog post is the same thing that can touch the bank. That is not a risk you manage with policy; it is a risk you design out. So we did.

What we rebuilt it into

Now a router sits in front. A small, fast model reads each request and names the tools it needs — not the answer, the shopping list — and the router dispatches the work to the worker that owns each tool and reassembles the results into one reply. Each capability is its own worker with exactly one integration: banking through Plaid (read-only), payments through Stripe, CRM through GoHighLevel, publishing through Ghost, mail through Microsoft 365, live web through Perplexity, data and memory in Supabase. Every worker holds only its own keys; secrets are pulled at run time from a vault that fails closed; and anything consequential is generated by one model, checked by deterministic code, and verified by a second model from a different lab before it ships. It all runs at the edge, on Cloudflare Workers.

The same engine, contained

The point of breaking it up was not tidiness. It was containment and reuse. Each worker can only do its one job, so a failure stays in one small box instead of taking the whole system with it. And because each piece is small and scoped, it is reusable — the worker that verifies a financial reconciliation is the same shape as the one that verifies a classification. That is the argument we make across every company we run: build the small, verifiable, contained thing once, then point it at the next problem rather than starting over.

Why it matters to the businesses

Least privilege stopped being a policy we enforce and became a fact of the wiring. The author never grades its own work — a second model, from a different lab, has to agree, and a human is on the calls that carry weight. Our customers inherit the consequences of how we build, so we build it to be verified and contained, not just convenient.

The full technical write-up lives on jessemyers.ai.