There's a temptation that every engineer who builds autonomous systems runs into: the urge to build it yourself. Your own auth. Your own ticketing. Your own wiki. Your own everything. It feels like control. It feels like you're doing it "right."
We don't do that. Our whole stack is built on a simple rule: maintain, don't create. We customize open-source software to fit our needs, but we almost never start from scratch — because starting from scratch is mostly unnecessary, and it's certainly more work than you get benefit from.
The trap: reinventing the wheel feels productive
The trap is that building your own version of something feels like real progress. You're writing code, you're making decisions, you're in control. But you're also taking on a permanent tax: every bug, every security hole, every feature request, every compatibility issue is now yours to own, forever.
The worst version of this is hand-rolling your own auth. Authentication is one of the hardest, most security-critical problems in software — and it's been solved, well, by people who've spent years on it. Writing your own auth isn't a shortcut to control. It's a way to inherit a security liability that someone else already solved.
The diagnosis: the cost isn't the build, it's the maintenance
The real cost of building from scratch isn't the weeks you spend writing it. It's the years you spend maintaining it. Every dependency you pull in, every edge case, every security advisory — that's all on you. When you use mature open-source software, you get a whole community maintaining it for you. When you build your own, you're the community, and it's a community of one.
We learned this the honest way. We run a self-hosted accounting application, a ticketing system, a wiki, DNS and ad-filtering appliances, home automation — and in every case, we started from mature open-source software and customized it, rather than building our own. The value we add isn't the software. It's the way we wire it together, secure it, and drive it with agents.
The fix: customize, don't create
The rule is simple: start from the best open-source tool for the job, then make it ours. That means:
- We customize, not fork. We configure, extend, and integrate mature software. We don't maintain our own divergent copy that we have to keep in sync with upstream forever.
- We use the standard, boring solution for the hard stuff. Auth, encryption, databases — we use the well-tested, widely-deployed option. Boring is a feature when it comes to security.
- We add value at the edges. The interesting work is in how the pieces fit together — the automation, the agent integration, the guardrails — not in re-implementing a login page.
There's a real example from our own books. We run a self-hosted accounting application, and it had a cloud-only restriction gating a feature even though we run it ourselves. We didn't rebuild the app. We removed the artificial restriction, kept a backup, and moved on. That's the difference: we work with the software, not against it.
The guardrail: the capability boundary
The discipline is knowing where the boundary is. We don't build what already exists and works. We build the things that don't exist — the automation, the agent orchestration, the guardrails, the integration layer. That's where the real value is, and it's where our effort goes.
The test for any new piece of work is simple: is there a mature open-source tool that does 80% of this? If yes, start there and customize. If no, then — and only then — is it worth building. Most of the time, the answer is yes, and the 20% you add is where the value lives.
The takeaway
The strongest agent deployments aren't built on a pile of hand-rolled code. They're built on top of real, mature infrastructure — customized, secured, and wired together by people who know how to run it. If you can't run the infrastructure, the agent is just a chatbot on a shaky foundation.
The value isn't in writing the software. It's in knowing which software to run, how to secure it, and how to make it work as a system. Maintain, don't create — and spend your effort where it actually pays off.
← Back to Field Notes