Cheap code moves the bottleneck to judgment

Small owning pods on a strong platform are one emerging pattern

One emerging pattern is small, flat, multidisciplinary pods of roughly 3 to 6 people who own outcomes end to end, on a strong platform that supplies agent tooling and deterministic guardrails. The evidence does not establish an optimal team size: Bain says "no single answer suits all" (Bain, Sep 2026), and in a Deloitte survey larger teams reported more AI use and more benefit, though that is self-reported and correlational (Deloitte). Across the sources, writing code is no longer the hard part; deciding what to build, verifying what agents produce, and pushing decision rights to teams is.

"Product engineer" is real and spreading, but in documented practice it means PM-light and PM-late, not PM-free. Big tech is cutting layers and shrinking teams, mostly without formally blaming AI. Measured individual gains vary widely by study and task, from a slowdown for experienced maintainers to roughly a quarter more completed work, and several studies find review load, instability or incidents rising alongside. Studies using different samples report relative declines in early-career employment in AI-exposed jobs, mainly through fewer hires. For security organizations in regulated industries, verification and guardrail capacity, not authoring capacity, is the resource to plan around.

Big tech is delayering first and attributing it to AI second

The consistent 2026 pattern is fewer layers, wider spans, player-coach managers and small generalist teams. AI is the stated rationale only some of the time.

Uber is the best-documented case. Agent-authored code changes rose from under 1% to about 8% by March 2026, when CTO Praveen Neppalli Naga described a "zero human authoring" workflow where engineers review and approve agent changes (Business Insider via AOL). By April, agents wrote about 11% of live backend updates and Claude Code usage blew past plan (Benzinga via Yahoo Finance). Spend became a constraint: secondary reporting put heavy users at $500 to $2,000 a month, against a lower average (Forbes), and described a $1,500 monthly cap per employee per coding agent by June (Tech Times). Uber built verification early: its uReview AI reviewer covers over 90% of ~65,000 weekly diffs (Uber Engineering, Aug 2025). The September 2026 restructuring cut about 10% of the workforce. In Uber's own words, it reduced "the number of employees who sit 7+ layers from the CEO by 20%" and nearly halved management "micro-teams" of one or two reports, consolidated Delivery Operations teams, and combined Core Services Engineering with Science. The announcement does not cite AI as the reason (Uber; TechCrunch). "Agentic Pods" embedded 30 AI-proficient engineers in finance, legal and HR; results are self-reported (BI via AOL).

Meta made the most explicit AI redesign and the most visible partial reversal. "Project OT" (Jan 2026) aimed to cut many teams by ~60%, with leadership describing "AI-native pods" of 3 to 5 doing the work of 10 to 20; that is an intended model, not a measured result (Pragmatic Engineer). AI impact entered 2026 performance reviews (eWeek). After ~8,000 cuts in May, weighted to managers, Meta began inviting ICs in its Applied AI division into management by September (Fortune, reporting Business Insider). Instagram's Adam Mosseri describes teams of four to six more generalist engineers (BI via Yahoo Finance).

Amazon has the clearest operating-model statement. Werner Vogels amended Working Backwards on Jun 30, 2026: when a team has conviction about the customer problem but real uncertainty about the approach, build a prototype before the doc, with everyone owning the product end to end. The small team he describes later grew into an organization of several hundred (All Things Distributed). GeekWire reports projects that took 30 to 40 people now run with 6 to 8; Swami Sivasubramanian claims a median 4.5x gain for restructured teams (internal, self-reported) (GeekWire).

Others: Google cut 35% of small-team managers in the year to Aug 2025 (NBC News, headline-level). Microsoft's announcement of its Oct 2026 voluntary exit offer does not attribute it to AI (Microsoft); Netflix's ~1,000 cuts cited no AI; Apple is retraining Siri engineers in an AI coding bootcamp (MacRumors). Coinbase (May 2026) replaced pure managers with player-coaches, capped layers at 5 below the CEO with spans of 15+, and is testing "one person teams" (Fast Company). Block cut ~40% explicitly citing AI (Semafor). Salesforce froze engineering hiring while expecting ~$300M of Anthropic token spend (Outlook Business). AI spend now competes directly with headcount budgets. Skeptics including Sam Altman and Forrester call much of this "AI washing" (Forbes).

"Percent of code written by AI" has become an investor-relations metric, and the figures are not comparable:

This review found no FAANG company that has published a PM:eng ratio change, and no verified 2026 manager:IC ratio for Google or Amazon.

The product engineer is PM-light and PM-late, not PM-free

A product engineer is a full-stack engineer who owns a feature from problem framing through shipping, talks to users and judges outcomes, with little or no PM layer. Lee Robinson framed it in 2023 as working backwards from the product experience (leerob.com). PostHog documents it best: engineers lead product teams, run support rotations and pick the roadmap, and early product teams usually have no PM (PostHog careers; handbook). Its co-founder later admitted he was partly wrong to resist PMs (PostHog newsletter, Dec 2024). Linear's current "Product Engineer, AI" posting adds prompt optimization and model evaluation to the job (Linear careers). The 2025-26 change is that evals, prompts and agent-facing surfaces joined the role. WorkOS runs about 1 PM per 80 engineers (Pragmatic Engineer, Jan 2026). These exemplars are mostly dev-tools and AI-native companies with technical users, which limits how far the model generalizes.

LinkedIn is the only large company with a fully documented ladder change. CPO Tomer Cohen introduced the "Full Stack Builder" in Jan 2025, wrote it into hiring and reviews in Aug 2025, and replaced the APM program with an "Associate Product Builder" program from Jan 2026 (BI via AOL). Specialist tracks persist ("System Builders" for platforms, "Craft Leaders" for standards) and no consolidation ratio was published; one analysis concludes LinkedIn changed a job description, not a staffing ratio (pearpages, Aug 2026). Meta retitled ~1,000 developer-tools staff "AI Builder" or "AI Pod Lead" in a March 2026 pilot (The Decoder).

The voices split into two camps that agree more than they admit:

• Engineers absorb product. Anthropic's Boris Cherny says that on the Claude Code team "everyone codes", including the product manager, engineering manager and designer, and predicts that "the title software engineer is going to start to go away" in favour of "builder" (Roger Wong, Feb 2026, quoting a podcast).
• Product becomes the bottleneck. Anthropic's Head of Growth says a 5-engineer team now produces the output of 15 to 20, PM capacity hasn't kept up, so Anthropic is hiring more PMs and deputizing engineers as "mini-PMs" on sub-two-week projects (Lenny's thread, Apr 2026, secondhand). SVPG argues the product trio persists because discovery still needs distinct judgment (SVPG).
• Andrew Ng moved. In mid-2025 he relayed a team proposing 2 PMs per engineer (HackerNoon); by Apr 2026 he saw engineer:PM ratios moving from about 8:1 toward 1:1 as engineers take on product work (The Batch #349).

Both camps agree handoffs (PRD → ticket → implementation) are shrinking and judgment is the scarce input; they differ on whether it sits in a specialist PM or in every builder.

The day-to-day loop: prototype several variants with agents instead of writing specs (Simon Willison: a UI prototype is "free now"; simonwillison.net), pick through usage data or evals, harden, measure, and unship. For AI products specifically, Anthropic's Dianne Penn calls evals "the new PRDs", while keeping written specifications for ambiguous problems and cross-team, legal and safety alignment (summary, secondhand). Non-engineers ship too: Intercom set a goal for PMs, designers and EMs to ship small changes (Fin Ideas); Ramp reportedly saw ~1,000 PRs from non-engineers in one month and split PM into Technical PM, Taste-maker and GM tracks (BuildBetter, secondhand). PM demand data conflict: TrueUp via Lenny Rachitsky showed PM openings at a three-year high in Mar 2026 (X), while a report cited by Forbes claims a 30% decline (Forbes).

Output rises, delivery lags, and stability pays the bill

The evidence trades rigor against recency: the cleanest RCTs predate agentic tools, and agentic-era data is mostly vendor telemetry and surveys.

DORA 2025 names seven capabilities that turn individual gains into organizational ones, including quality internal platforms, small batches and a clear AI stance (RedMonk). Qodo's Sep 2026 survey (a vendor that sells AI review) finds reviewing AI code the top delivery bottleneck, and only 45% of leaders can trace AI activity to code changes (Qodo). Charity Majors' summary: AI demands more engineering discipline, not less (via Simon Willison).

Two results support small autonomous units, with limits. In a pre-registered RCT of 776 P&G professionals, one person with AI matched a two-person team without it on average and bridged R&D/commercial silos, though teams with AI were more likely to produce top-decile solutions (NBER w33641; published version; non-software). A GitHub quasi-experiment found Copilot shifted maintainers from coordination toward coding, more autonomous and less collaborative (CESifo WP 11479). Together: AI makes the individual a more complete unit but loads verification and operations, so small pods need stronger platform, quality and SRE support, not less.

The academic literature confirms convergence and warns about review and learning

A structured literature screen in Elicit of 20 papers (2022-2026) points the same way as the industry accounts. The reading below, that role convergence runs both ways, and gains track workflow redesign rather than tool access, is this brief's interpretation of those papers.

• Convergence. Ulloa et al. (2025) surveyed 885 Microsoft PMs plus telemetry: PMs now script, prototype and build agents, with delegation shaped by identity and accountability. Li et al. (2025, 22 interviews) found designers coding more and developers shifting to oversight and product thinking, with new asymmetries in trust and responsibility. Zhang et al. (2026) describe vertically integrated "Super-Cells"; their 8-33x person-month reduction is a projection, not a measurement.
• Capacity. He et al. (2026), a staggered difference-in-differences study at one company with 802 developers and 196,212 PRs under a "2x" mandate: merged PRs per engineer reached 2.09x at peak, a conservative model associated adoption and accumulated use with 1.46x (the authors caution against exact causal attribution), per-reviewer load roughly doubled in what they call a near-best-case rollout, automated review overtook human review, and merge and revert rates held. Song et al. (2026 revision): Copilot use raised project-level code contributions in open source by 5.9% and coordination time by 8%.
• Experience. Vella & Blincoe (2026) ran two surveys six months apart (158 respondents at first, a matched cohort of 95): perceived productivity stayed positive, yet the share reporting a worse experience on at least one developer-experience dimension rose from 14% to 27%. They name the new category "supervisory engineering work."
• Closest analog. Vilas Boas et al. (2026): one staff engineer with four agents at a financial institution delivered five features in three sprints vs. six planned for a four-person team, with 90% first-review acceptance. Binding constraints were spec quality and institutional knowledge; authors say it is no general substitute for teams outside bounded, familiar brownfield work.
• Team learning. Ulfsnes et al. (2024): consulting AI instead of colleagues disrupts knowledge sharing ("pair prompting" helps). Miller et al. (2025): productivity pressure without learning support undermines the skill growth that produces the gains. Rico & Öberg (2025) and Sun & Staron (2026) expect managers to move into AI governance, with traceability and artifact certification still open problems.

Caveat: the literature is mostly qualitative and single-organization, and this review found no large-sample study that measures AI-driven team-size change directly.

The junior pipeline narrows through missing hires, not layoffs

Labor-market data is the most rigorous evidence here, and it points to a slow-building senior-pipeline risk.

• Stanford's "Canaries in the Coal Mine" (ADP payroll data): employment for 22-25-year-olds in AI-exposed jobs is 19% below the comparison trajectory as of Jun 2026, up from 13% a year earlier, mainly through reduced hiring rather than separations. The authors call it descriptive, and note that effects shrink with education controls and that some trends predate generative AI (Stanford DEL).
• Hosseini & Lichtinger: junior employment at GenAI-adopting firms down 9-10% after six quarters while senior employment kept growing (SSRN 5425555).
• Indeed: software postings are 27.5% below Feb 2020, and senior roles account for 71% of the 2025-26 rebound (Indeed Hiring Lab, Jul 2026).
• Bain: juniors fell from about a third of team composition to under a fifth (Bain, Sep 2026). Gartner predicts firms cutting junior roles will have weakened talent pipelines by 2028.

This sits awkwardly with the field experiments, where juniors gained most from AI (Cui et al., though mostly not significant). Firms appear to be substituting AI for junior task bundles rather than amplifying juniors, leaving no clear source for tomorrow's senior reviewers.

Management is reshaping too. Gergely Orosz sees EMs managing 12 to 14 people, up from 4 to 8; Will Larson says tech-lead managers are in demand and leadership "as we know it" won't survive three years (Pragmatic Engineer, Oct 2026). Meta's September move back toward managers is the counterweight: over-flattening costs workload strain and lost domain knowledge.

Frameworks agree on bounded agency, platforms and decision rights

Gartner (Jul 2026) predicts 60% of organizations will run "tiny teams" of 4-5 at scale by 2029, up from 15% in 2026, including a PM and an "agent experience" designer, on platform engineering, and explicitly not as cost optimization (People Matters recap; primary not retrieved).

Bain's "Half-Finished Redesign" (n=155) gives the sharpest diagnosis. Traditional pyramids fell from 66% to 29% and engineer time spent directing agents rose from 4% to 23%, but 70% still decide centrally, so approvals and escalations haven't moved. The fix is redistributing decision rights: where humans decide, where agents act, who owns the outcome (Bain, Sep 2026). McKinsey recommends cross-functional pods with governance expertise plus an AI-native platform team owning guardrails, and names a "model governance officer" role (McKinsey, Jul 2026).

Team Topologies carries over largely intact, per Matthew Skelton: stream-aligned teams steward services, platforms deliver capability as a service, and cognitive-load limits map to agent context windows. He adds "bounded agency" (citing OWASP LLM06 Excessive Agency) and an "Innovation and Practices Enabling Team" that spreads working patterns by opt-in, not mandate (InfoQ, Mar 2026). Kief Morris on martinfowler.com puts humans "on the loop": engineer the harness of specs, checks, evals and telemetry, and fix the system rather than each artifact (summary). Thoughtworks Radar Vol. 34 calls for a return to fundamentals against "cognitive debt" and treats zero trust and sandboxing for agents as table stakes (PR Newswire).

Security guidance has converged on treating agents as identities. At the May 2026 SF AppSec Summit, practitioners said manual code review is no longer the primary control, and recommended a revocable identity per agent, logged tool calls, per-invocation scoping, sandboxing, egress allowlists, no ambient credentials, and human approval for irreversible actions (GitGuardian recap, vendor-hosted). A practitioner mapping adds that guardrails must be deterministic code, not prompts, and a guardrail duplicated across three teams belongs in the platform (Wulveryck, Jun 2026). No source publishes AppSec:developer or reviewer:agent ratios for the agent era.

What this means for security engineering in regulated industries

Synthesis and judgment drawn from the evidence above, not sourced fact.

Team shape. Move toward stream-aligned pods of about 4 to 6 that own a security product or control end to end: problem, build, rollout, adoption metrics and on-call. Write "product engineer" into the ladder as expectations (user contact, outcome ownership, evals) rather than using it to remove roles. Keep a distinct platform function that supplies the paved road for agent use, and consider a small enabling team that spreads working agent patterns across the enterprise. As a proposed risk policy, avoid one- and two-person teams for regulated controls, because key-person and segregation-of-duties risk make them fragile under audit; check the specific control framework that applies. Flatten deliberately; Meta's reported management changes suggest coordination needs persist after flattening, though their net cost is unknown.

Review and verification capacity. Stress-test review capacity against the doubling of per-reviewer load seen in one company's rollout (He et al.), measure actual reviewer load during any pilot, and budget reviewer time explicitly. Brownfield, compliance-heavy code sits at the low end of the gain range, so don't size teams on vendor or big-tech figures. Point human review at intent, design, threat models and irreversible changes; let AI first-pass review and deterministic checks (policy-as-code, mutation tests, generation-time SAST and secrets scanning) handle line-level work. Track review latency, PR size, unreviewed-merge rate, change failure rate and incidents per change. Percent of AI-written code and PR counts measure activity, not outcomes.

Guardrails for agents. This is where a security engineering org can do the most for the wider enterprise, and it is a natural platform product: per-agent revocable identities, scoped short-lived credentials, sandboxed execution, egress allowlists, logged tool calls, approval gated on reversibility, and traceability from agent activity to code change: the gap only 45% of leaders say they can close, and one regulators and auditors will ask about. Guardrails should be code, not prompts, and apply equally to humans, agents and pipelines. Expect AI spend to compete with headcount, as at Uber and Salesforce, and build cost observability into the platform.

Junior pipeline. Keep hiring early-career engineers deliberately, as a resilience investment. Redesign the junior role around verification, threat modeling, eval writing and supervised agent direction, and pair juniors with seniors ("pair prompting") to offset the team-learning loss the literature documents. Don't attach productivity targets to juniors without learning support.

PM:eng. For a security platform whose customers are internal engineering teams, a PM-light model (roughly one product-minded lead per one to three pods, engineers as mini-PMs on small scopes) is defensible because users are technical and reachable. Don't drop product judgment: adoption, prioritization across business lines and alignment with risk, compliance and audit are exactly the coordination work no source says AI has automated.

Transition: from the traditional split to an AI-native model

The documented cases follow a recognizable order; the firms that skipped steps are the ones patching side effects.

1. Change job definitions before headcount. LinkedIn rewrote its ladder (Full Stack Builder) and hiring and review criteria first, and never published a consolidation ratio.
2. Pilot pods on bounded work. Meta planned 3-5 person "AI-native pods"; the Vilas Boas bank case worked because the work was familiar brownfield with tight specs. Amazon added prototype-first for work where the approach is uncertain.
3. Build the harness before scaling. Uber had its AI reviewer (uReview) covering 90%+ of diffs before agent-written code reached 8-11% of changes. DORA's framing: AI amplifies whatever system it lands in.
4. Move decision rights along with the boxes. Bain's central warning: most firms reshaped teams, but 70% still decide centrally, so approvals and escalations became the new bottleneck. Define where humans decide, where agents act, and who owns each outcome.
5. Then resize. Meta cut first and is now adjusting by inviting engineers back into management. Uber capped AI spend in June, before its September restructuring.

Synthesis: run it as a sequence of experiments with explicit exit criteria rather than a single reorg. Gate each step on leading indicators: review latency, PR size, unreviewed-merge rate, change failure rate, incidents per change, never on PR counts or percent of AI-written code.

Middle managers: four paths, and a warning

The evidence shows where managers are going, but almost nothing on how to make the transition well.

The warning is Meta: it cut ~8,000 in May 2026, weighted to managers, then began inviting ICs back into management by September (Fortune). Coordination load and domain knowledge don't disappear with the role. Uber's September changes, which cut deep layers and management micro-teams, came with merged divisions, not a stated AI rationale.

Synthesis: in a regulated organization, governance, risk ownership and audit liaison are real landing spots, not consolation prizes, because that coordination work is exactly what AI hasn't automated. Decide each manager's path explicitly and early, and widen spans only as platform tooling and decision rights reduce coordination load.

Internal platform teams: agents as customers, risk as value

DORA and McKinsey treat platforms as more important in this model: DORA 2025 lists quality internal platforms among its seven AI capabilities, and McKinsey puts guardrails in a dedicated AI platform team. Faros disagrees that mature foundations protect against downstream decline ("Strong engineering foundations do not protect you"), so how much a platform shields an organization is unresolved (Faros).

• Agents are now customers too. Expose capabilities through APIs and MCP, and make internal docs and data AI-accessible (another DORA capability). Design the paved road for agents as well as engineers.
• Guardrails as a product. Ship agent identity, scoped short-lived credentials, sandboxing, egress controls and agent-to-code traceability as deterministic code, not prompts. A guardrail duplicated across three teams moves into the platform (Wulveryck).
• Verification as a service. AI first-pass review, policy-as-code and generation-time scanning absorb review load, which roughly doubled per reviewer in one company's rollout (He et al.).
• Cost observability. AI token spend now competes with headcount (Uber, Salesforce); the platform should make spend per team and per workflow visible.
• Keep a product function. Internal users are technical and reachable, so PM-light fits, but cross-business prioritization and alignment with risk, compliance and audit still need an owner.

Synthesis: risk as measurable value delivery. Treat each control as a product with adoption and outcome metrics, so risk reduction shows up as value rather than overhead:

DORA names value stream management as what turns individual AI gains into organizational ones, so these metrics can sit directly on a value stream map alongside delivery work.

Published pilots share a shape but rarely set exit criteria

The published pilots reviewed here share a shape: bounded scope, short time box, a baseline to beat, and a human validation gate. In the accounts reviewed, exit criteria and downstream measurement are mostly missing: the academic studies find the costs show up in review load, incidents and team learning, which pilots rarely track.

Documented examples

What org and people theory says about pilot design

Established theory applied to the evidence above; the application is synthesis.

• Sociotechnical systems (Tavistock, Trist & Bamforth). New technology underperforms when the technical system is optimized and the social system is left alone; the gains come from joint optimization. This is the academic finding restated: gains track workflow redesign, not tool access. A pilot that only hands a team agents tests the wrong thing. Redesign roles, review flow and decision rights with it.
• Conway's Law and the inverse Conway maneuver. Systems mirror the communication structure that builds them. A pod that owns a control end to end may produce a more cohesive control, if its boundary matches a real service boundary. Pick pilot scope along an existing architectural seam, or the pod inherits cross-team handoffs it can't remove.
• Coordination cost and Brooks's Law. Communication paths grow as n(n−1)/2: 10 people have 45, 4 have 6. One hypothesis is that small pods gain mostly by cutting paths, not by typing faster. Agents may add a new path type, human-to-agent supervision, which would help explain the rise in review load; the studies do not test this mechanism. Count review as coordination cost when sizing the pod.
• Mintzberg's coordination mechanisms. Large teams coordinate by direct supervision and standardized process; small autonomous ones by mutual adjustment. Agent work pushes toward standardization of outputs: specs, evals, policy-as-code. The pilot should invest in those artifacts; they are what let a 4-person pod coordinate with the rest of the org without a manager layer.
• Galbraith's information-processing view. Structure exists to move information to where decisions are made. AI raises a team's processing capacity, so central approval becomes the bottleneck (Bain's 70% still deciding centrally). Give the pilot pod explicit decision rights in writing: what it can ship, approve and change without escalation, or you are measuring the old approval chain.
• Cognitive load (Team Topologies). Each team has a finite load budget; Skelton maps agent context windows onto the same idea. A pod doing product, build, review, on-call and agent supervision can exceed it. Track load directly. Vella & Blincoe saw the share reporting a worse experience nearly double while perceived productivity held.
• Exploration vs. exploitation (March) and ambidexterity (O'Reilly & Tushman). Pilots are exploration, but published wins are exploitation of known work. Run the pilot as a protected unit with different metrics, then plan explicitly how practices integrate back into the wider organization.
• Hawthorne and selection effects. Volunteer selection and executive attention may lift performance independently of the intervention (the classic Hawthorne story itself is disputed: Levitt and List). Use a comparison pod, measure for a full quarter, and don't generalize from your most enthusiastic team.
• Psychological safety (Edmondson). Pilots announced next to layoffs (Meta, Coinbase) teach people to hide problems and overstate wins. Separate the pilot from headcount decisions in communication and in fact, or the data will be optimistic.
• Professional identity and role theory. Ulloa et al. found PM delegation to AI shaped by identity and accountability as well as capability. Changing titles (LinkedIn, Meta) is a lever, but people need to see what "good" looks like in the new role, so write it into the ladder before the pilot ends.
• Situated learning (Lave & Wenger). Juniors learn through legitimate peripheral participation in real work. When agents take the peripheral tasks, the on-ramp disappears (Ulfsnes et al.; the Canaries data). Put at least one early-career engineer in the pilot with an explicit learning plan.
• Goodhart's Law. Uber ranked engineers on AI-usage leaderboards; Miller et al. describe the Productivity Pressure Paradox. Once a metric becomes a target it stops measuring. Don't make AI usage or PR count a pilot target.
• Diffusion of innovations (Rogers). Adoption spreads through peer observability and trialability, which is why Skelton favors opt-in enabling teams over mandates. Plan for the pilot team to demo and pair with other teams as well as report up.

Pilot blueprint

Synthesis for security engineering teams in regulated industries.

1. Pick scope on a seam. One or two security controls or platform features with known scope and a clean service boundary; a comparison pod on similar work without the new model.
2. Compose the pod. 3-4 people: a senior engineer who can own product decisions, one or two engineers, one early-career engineer with a learning plan; access to a product-minded lead and a risk partner.
3. Write decision rights down. What the pod ships and approves on its own; what needs a human gate (anything irreversible, anything touching regulated controls); who owns the outcome.
4. Build the harness first. Agent identities, scoped credentials, sandboxing, traceability from agent activity to change, AI first-pass review, policy-as-code.
5. Time-box to one quarter with a baseline: the original plan or estimate for the same work.
6. Set exit criteria up front, across four lenses:

7. Separate it from headcount. Say so explicitly, and mean it, so the data stays honest.
8. Plan reintegration. Decide in advance which outcomes trigger a second pod, which practices move into the platform, and what changes in the career ladder.

Scarcity relocates to judgment, verification and decision rights

The industry frames this period as code becoming free; the evidence reframes it as scarcity relocating: to deciding what to build, verifying what was built, and the decision rights and guardrails that let small teams act without central approval. That reading fits the contradictory moves: Uber caps AI spend and then cuts layers, Meta flattens then rebuilds some management, and Anthropic has everyone code while hiring more PMs. The "product engineer" is best read as a demand that every engineer hold some product and verification judgment, because handoffs are now the costliest part of the system.

Two things remain unknown as of late 2026: this review found no rigorous study showing solo or duo pods beating 5- to 8-person teams on real enterprise work, and organization-level longitudinal evidence on agentic-era delivery outcomes is limited to single-company studies such as He et al. Treat big-tech restructurings as experiments with visible side effects, not templates. The defensible bet is to invest where most of the sources place the constraint now: verification capacity, deterministic guardrails and traceability, decision rights pushed to small owning teams, and a deliberately preserved junior pipeline.

Notes: several big-tech details rest on headlines or secondhand podcast summaries and are labeled as such; vendor figures (Faros, GitClear, Qodo, DX) are flagged inline.

How this was made

Question. How are AI coding agents changing software team structures, roles such as the product engineer, and management layers, and what follows for security engineering organizations? Set by Julie Davila in October 2026.

Process. The research was done in a conversation with Claude on 29 October 2026, using web search across company announcements, engineering blogs, press coverage, practitioner newsletters and labour-market reports, plus a structured literature screen in Elicit that included 20 academic papers from 2022 to 2026. Claude drafted the brief as a shared document, which Julie Davila reviewed and then brought onto this site, where the sections written for regulated industries were made general.

What was checked and what was not. Several big-tech details rest on headlines or secondhand podcast summaries and are labelled as such inline. Vendor figures (Faros, GitClear, Qodo, DX) are flagged where they appear. Passages marked Synthesis are reasoning from the evidence, not sourced findings. The Elicit screen's export and the full 20-paper list are not published here; the papers that carry findings above are linked.

Adversarial review and corrections (version 1.1, 29 October 2026). A model from a different vendor (OpenAI GPT, run read-only through Codex) checked the brief's claims against their sources. It confirmed about 50 claims and raised 28 findings; the most consequential were checked again against the primary texts before any change. Version 1.1 corrects: Uber's September restructuring (20% fewer employees seven or more layers from the CEO and fewer management micro-teams, not a 20% manager cut), the order of Uber's spending cap and restructuring, and Uber's spending figures; Boris Cherny's remarks (everyone codes today; the title change is a forecast); the Song et al. figures (one paper version); the Vella and Blincoe sample (a matched cohort of 95); the Stanford result (an employment gap, mainly through hiring); Microsoft's announcement (no stated AI reason, not a denial); and the Meta pilot, Amazon, Faros, Cui et al., METR, GitClear and DX descriptions. Overclaims about best practice, pooled productivity, platform consensus, pilot failure and Hawthorne effects were softened or removed, Deloitte's contrary team-size finding was added, and gap statements now say they reflect this review's searches.

Sources

Every source linked in the text, in order of first use.

---

Julie Davila · Research. Researched with AI agents and reviewed by Julie Davila: how this research is made. Text licensed CC BY 4.0. Source on GitHub.