Why Auth and Workflow Are More Important Than Your Code

Who this is for: founders and engineering leaders deciding where the next month of effort should go.

Here's the uncomfortable truth in the agentic era: the code you write is the cheapest part of your system. An agent can regenerate it in an afternoon. What stays expensive — and career-ending when it's wrong — is two things: who can do what (auth) and what must happen, in order, exactly once, on the record (workflow). Spend your month there, and the app becomes disposable glue. That's the goal.

The recipe

1. Find the auth. Every role check scattered through your handlers belongs in ory (principals + roles) and Postgres Row-Level Security (the database says no).
2. Find the workflow. Every multi-step process held together by a status column and hope belongs in temporal — durable, exactly-once, resumable, audited.
3. Declare them. kilter init, then add ory, temporal, and postgres to kilter.yaml.
4. Move access into the data layer. Roles become Ory principals; access decisions become RLS policies enforced on every query, not in seventeen endpoints that are correct in sixteen of them.
5. Move process into the workflow engine. Each lifecycle becomes a Temporal workflow that can't be sidestepped.
6. Ship. kilter deploy — live in production, Org Only. Your code is now thin glue over load-bearing infrastructure; hit Promote to expose it when you're ready.

When auth and workflow live in infrastructure you can point an auditor at, the code on top becomes cheap to rewrite — which is exactly what you want when agents are doing the writing.