The most valuable asset at one of the world’s largest shipping companies is not a model. It is a corpus of standard operating procedures that is roughly twenty times larger than the runtime that executes against it. Dmitry Buykin, an engineer building AI agent systems for Maersk’s global shipping operations, calls the source material “tribal dungeons” — operational knowledge that exists inside the organization but in a form no agent can execute safely. Speaking on the AI Engineer podcast, Buykin delivered a blunt calibration for anyone who thinks production AI is a model problem: “The agent loop is not the system. The refining loop around the agent is the system and it’s the most complex part.”
That distinction matters now because the AI industry is drowning in demos and starved for deployments. Meta’s Project OT collapsed after AI-generated code changes caused a 40% rise in major technical incidents while visible user features grew just 36%. Best Buy’s agentic commerce lead admits fully autonomous payments are still not happening. Against that backdrop, Maersk is running over 200 concurrent agent instances in production across global shipping operations. The difference is not a better model. It is a methodology.
The translation gap: what a person sees is not a process
The core problem Buykin identifies is representational. In regulated industries, legacy SOPs explain what a person sees and clicks — often “a bunch of screenshots organized in sequence.” But screenshots are not a process. An agent SOP requires a fundamentally richer structure: preconditions, decision points, identifiers, backend calls, validation steps, recovery paths, and evidence of successful execution.
“Legacy SOPs explain what a person sees and clicks. And an agent SOP needs a more complex setup, preconditions, decisions, identifiers, back end calls, validation, recovery, and evidence of successful execution,” Buykin noted.
The translation is not a technical exercise; it is a negotiation. Experts and engineers must align on “common sense” — what constitutes a successful outcome, what counts as a recoverable failure, and what should halt the process entirely. The SOP corpus becomes an asset in its own right, a form of “process memory” modified and aligned with each country’s conditions. The scale disparity is stark: the corpus is roughly 20 times larger than the runtime that executes against it.
This is the part of AI implementation that never appears in vendor slide decks. The “easy majority” of operational workflows is already automated at most companies. What remains is the long tail of exceptions, and that tail is where the cost lives. In global shipping, every shipment is an orchestration of parallel state machines. When any one drifts from the happy path, exception work begins — and that work is bottlenecked not by model capability but by expert time and legacy system latency.
The architecture: agent loop, refining loop, and the feedback that binds them
Buykin lays out the production architecture in three components: SOP memory organized as a corpus, an execution runtime, and a theme feedback capture loop.
The feedback loop is where quality is earned. Over nine months of development, the team accumulated more than 100,000 corrections. But volume is not the point; conversion is. “A correction only counts when it becomes an executable change. And that’s the line between an opinion and a production fix,” Buykin said.
The trace is the shared evidence that lets an expert and an engineer review the same case and agree on what happened. Without that, you have competing narratives. With it, you have a path to a fix. Buykin identifies this joint review as a prerequisite for any meaningful improvement.
The heat maps are the operational tool that makes the feedback loop tractable. They turn thousands of traces into priorities, clustering failures so that experts and engineers look at the same problems. Each cell in the heat map represents a group of tracked scenarios. Turning one red block to green typically requires one to two months of effort from the whole team — engineers and AI agents combined. An agent failure is where investigation starts, not where it ends. Each failure maps to a specific fix.
Safety is structural, not prompt-level
Buykin is explicit that safety cannot be a prompt-level concern at this scale. “Please be careful is not a guard.” The harness exists not to give the agent more room but to make dumb mistakes impossible. “Discovery needs agent freedom and production needs a cage,” he noted. “The harness isn’t there to give the agent more room. It’s there to make the dumb mistakes impossible.”
The system uses layered guardrails, each keyed to a specific failure mode:
Failure typeGuardrail mechanismWrong workflowClassifier evalWrong right (correct outcome, wrong method)Right gateWrong assumptionReviewUnsafe path on critical pathsPreventive eliminationHigh-stakes decisionsHuman review and approval stay in the loop
The engineering focus is “safe handoffs and a trail you can trust.” This is a structural answer to a structural problem. The guardrails are built into the system design, not layered on as prompt instructions that a model might or might not honor under edge-case pressure.
Composite tools: how improvement compounds
The final mechanism Buykin describes is aggregation. The system identifies repeatable sequences of steps from successful scenarios and merges them into larger, reusable tools that other agents can invoke. Proven scenarios become snippets; snippets become deployable across hundreds of countries in one rollout rather than being re-derived per country.
This adaptive architecture is the asset, not the model. Buykin makes a pointed product decision that underscores the priority: the team does not use MCP (Model Context Protocol), despite its popularity. His reasoning is quality control. MCP systems are “usually really bloated,” and the team needs to distill responses and tune tools through direct function calling to control software quality and ensure correct task processing. When you are running 200+ concurrent instances against legacy backends that cannot move faster than the agent loop itself, bloated abstraction layers are a liability, not a convenience.
MetricValueConcurrent production agent instances200+Latency range (legacy system constrained)Few minutes to 10 minutesCorrections accumulated over 9 months100,000+Corpus size relative to runtime~20xTypical time to turn one heat-map block from red to green1-2 months of team effort
The effort ratio is the episode’s most damning indictment of typical AI project planning. Most teams stop at the coding stage. Buykin presents a cognitive effort distribution where the bulk of work happens after the happy path is working. “Accuracy wasn’t designed in one diagram up front. It was earned one small correction at a time at the scale you see here,” he said.
The five moves: a blueprint for AI-native operations
The methodology that emerged from the work is what Buykin considers the real outcome — not the agent in the system, but the system around the agent. He distills it into five moves:
Make work representable — translate tribal knowledge into executable SOPs
Make execution bounded — constrain the agent’s action space structurally
Make behavior observable — traces that experts and engineers can jointly review
Make correction cheap — feedback loops that turn failures into executable changes quickly
Make improvement compound — aggregate successful sequences into reusable composite tools
The predictions that follow are medium-confidence but directionally significant. Composite tools built from successful scenarios can be rolled out to hundreds of countries in one go. Aggregating successful repeatable sequences will allow solutions to scale across geographies without per-country customization.
The unresolved tension is the human cost. Expert time is the bottleneck. Turning one heat-map block from red to green takes one to two months of sustained team effort. The system’s scalability across countries is real, but it is purchased with a heavy, ongoing investment in translation, review, and correction.
For investors and technologists evaluating AI agent deployments, Maersk’s experience is a useful filter. The question is not “which model are you using?” but “what does your correction loop look like?” Organizations that treat their SOP corpus as a first-class asset — and their feedback loop as the actual product — will be the ones that survive the transition from demo to production. The rest will ship agents that work in the happy path and shatter in the long tail, which is precisely where the operational costs live. Buykin’s account is notably free of model hype; the models are treated as “oriented intelligence,” a component whose value is realized only through the architecture around it. The agent is not the system. The refining loop is. And the refining loop is where the work — and the durable advantage — actually lives.