Production engineering for AI-built systems that customers already depend on
Production engineering for AI-built systems is the work between a demo that works and a system you can leave running. Your team built it with Claude Code, Cursor or Lovable, people use it now, and nobody is sure what happens when traffic doubles.
Production engineering
- Built with
- Claude Code, Cursor, Lovable
- Review
- Paid, five working days
- Scored on
- Ten layers
- Includes
- A load test
- Then
- A fixed-scope sprint
The short answer
Production engineering here means taking an app or agent generated with AI coding tools and making it safe to leave running: database access rules, no secrets in the browser, rate limits, error tracking, deploys you can roll back and a load test. Digiton scores the system against ten layers in a paid five-day review, then fixes what fails in a fixed-scope sprint.
Page one teaches engineers. Your app still needs fixing
The UK results for production AI engineering that we recorded on 3 October 2026 were mostly lessons. Four of the ten were courses, three were Medium, Substack and YouTube posts, and one was a university research theme. The two firm pages were a practitioner's explainer and a data platform's guide.
Courses teach engineers the craft. If you need your own system fixed this month, a course is the long way round. We work on the codebase an AI tool already wrote, and we start with row-level security, rate limits, security headers and a load test.
The ten layers we score
This is Digiton's own production standard. Each layer gets GOOD, PARTIAL or MISSING, with the command or file that proves it.
- Frontend bundle. Minified, no source maps, no secret keys in the browser.
- Database access. Row-level security on every table holding user data.
- Version control. A protected main branch and a CI gate that blocks a red build.
- API. Input validated at the boundary, one consistent error shape.
- Hosting and deploys. A preview for every change and a rollback path you've tried once.
- Security headers. An enforcing content security policy, HSTS and CSRF protection on writes.
- Rate limiting. On every public route and every route that calls a paid model.
- Caching. On read routes, never on a response that belongs to one user.
- Scaling. Counters, locks and queues moved out of memory.
- Error tracking. Client, server and edge, so a failure reaches you before a customer email does.
Proof you can check yourself
We build our own products the same way.
Parci, Digiton's real-estate AI platform, runs a graph of six agents over hybrid retrieval and covers 300 of 308 Portuguese municipalities. We built it, and we run it in production.
Our internal operations run on ten scheduled agents. Each is one Node file on a timer, and every irreversible action passes five rails first: a kill switch, a do-not-contact list, an allowlist, dedupe and a daily cap. The code is public on GitHub.
The review, and what comes after it
- Scoping call. Free, 25 minutes, and it decides whether the system fits.
- Production review. Five working days on the real repository and infrastructure. You get a scorecard for the ten layers with evidence, the result of one load test, and a fix list with a cost on every line.
- Fixed-scope sprint. Usually two to six weeks, and it ends when the acceptance tests pass.
- Operations. Optional: monitoring, on-call and the next round of changes.
We use the same coding agents you do, and our comparison of Claude Code, Cursor and Codex shows how we weigh them. A platform that needs more than hardening belongs under custom AI development, and agents acting in your systems under AI agent development. Teams can also start at AI consultancy in Luxembourg or AI consultancy in Dublin.
Digiton Dynamics OÜ is registered in Tallinn, Estonia, and delivers from Lisbon.
Frequently asked questions
What breaks first in code an AI tool wrote?
The scaffolding around the feature. Tables that anyone holding the public database key can read because the access policy was never switched on. Payments that show success on screen while nothing on the server confirms the charge. A paid model endpoint with no limit, keys in the client bundle, and no error tracking at all. None of this means the tool did a bad job. The prompt asked for a feature, and the feature works.
Will you rewrite the whole app?
Rarely. The review shows which layers fail, and the sprint fixes those. A rewrite only comes up when the structure itself can't carry the load, and the review will say so in writing with the reason.
Do you work on Lovable, Supabase and Vercel projects?
Yes. Many AI-built apps sit on that stack, and the database access rules in Supabase are often the first thing we check. Moving off a builder's hosted backend to your own Supabase project can be one line on the fix list.
Is the first look at our code free?
The 25-minute scoping call is free. The review that reads your code and infrastructure for five days is paid, because it produces a scorecard, a load test and a priced fix list your team can use with or without us.
Do you need production access?
Read access to the repository and the hosting dashboards is enough for the review. A staging copy is best for the load test. Write access only comes with the sprint, on terms you set.
What if the review says the system is fine?
Then you have that in writing, with evidence for each layer, and you ship with less doubt.
Talk to an engineer about your system
Book a free 25-minute scoping call. We tell you what we would build, what it takes to keep it running, and whether we are the right fit.