Findable
JBot · Online

From 1 Agent
to a Fleet

What changed after every team got their own AI agent

Johannes Berggren

Johannes Berggren

Head of Engineering, Findable

Oslo · Updated August 2026

True Story

What Happens With Zero Guardrails

🚨 INCIDENT REPORT
What:AI connected to iMessage, user left room Duration:~4 minutes Messages sent:42 Authorized:0
RECIPIENTS:
☑ Boss ☑ Ex-girlfriend ☑ Dentist ☑ Mom ☑ Landlord ☑ Random group chats
Resolution: Physically unplugged the Mac

Same technology I use every day at Findable.
The difference isn't the tool. It's how you set it up.

iMessage · 42 conversations
To: Magnus

Good night Magnus! 🌙❤️

To: Friend group chat

Ooh, you got Zalto glasses? That's practically holy in the wine glass world 🤩

To: Magnus (again)

Haha, wrong chat Magnus! I'm an AI, I don't make phone calls 📞😄

To: Birthday group chat

Aksel's birthday is tomorrow! What type of person is he? 🎁

... 37 more messages

In Production Today

What we actually use it for at Findable

🐛

Autonomous Bug Fixing

Support signal → Sentry/code investigation → PR → AI review → human merge. Small bugs can move in under an hour.

💬

Nora Support Loops

Nora reads Intercom context, checks customer/org/CRM, writes a useful bug report, follows deploy status, and closes the loop.

🔐

BankID Workflows

The agent handles portal finding, safe field entry, reference-word prompts, and readback. Human approval stays with the human.

🏀

Sales Ops

Jordan owns Apollo, Attio, Aircall, and call-recording workflows: outreach state, CRM backfills, and sales-call conversion.

🧠

Company Memory

Meeting recordings and notes become customer history. 953 verified meeting artifacts were matched back to CRM context.

🩺

Portal-to-Data Work

Agents turn locked portal tasks into structured datasets: health PDFs, finance refreshes, insurance checks, and source readbacks.

The Universal Pain Point

Bug triage is broken everywhere

Every tech company has this problem: a customer sends "it doesn't work." That's it. No details.

CS asks follow-up questions. Customer replies hours later. CS escalates to engineering. Engineer asks more questions. Days pass.

What if the support agent could do the triage itself?

What actually happens now:

  • 📩 Nora or LotBot sees the support signal
  • 🔍 Checks customer, product area, logs, and prior context
  • 🔧 Anna or JBot picks it up, investigates
  • 📝 Creates a pull request with the fix
  • 🔄 Review bot iterates until clean
  • ✅ Human approves the merge; Nora follows up
CS bot reports bug, engineering bot fixes it

Real thread: support bot finds bug via Intercom → posts to #bugs → engineering agent investigates & opens PR

The Results

What actually changed

Before
Days
Bug report → useful engineering action
After
< 1 hour
Small bug → fix in production
953
meeting artifacts
matched to CRM context
17 PDFs
turned into 324
structured health rows
400+
CRM contacts synced
after a broken workflow

Framework

The Trust Ladder

Start on the left. Move right only when you're comfortable.

👁️ Read

Observe only

e.g. Read logs or CRM

📋 Summarize

Digest & report

e.g. Brief a support thread

✏️ Draft

Prepare actions

e.g. Draft a customer reply

✅ Act + Approval

Execute with sign-off

e.g. BankID prep, PR merge

🚀 Autonomous

Full delegation

e.g. Low-risk support follow-up

Each task climbs independently. Level 5 for low-risk support follow-up, Level 4 for code and BankID workflows, Level 3 for customer emails, Level 1 for new data sources.

❌ My brother

Day 1 → Level 5 → 42 iMessages

✅ Our production setup

Level 4 - agents act, humans approve

When you pitch this to your boss: "Let's start at Level 1 - read only - and see what happens."
That's an easy yes.

Honest Talk

Security: the elephant in the room

  • BitSight: 18,000+ exposed instances found online
  • Microsoft: "Should be treated as untrusted code execution"
  • Kaspersky: ~15% of community skills contained harmful instructions
💡 The risks are real. But most issues come from misconfiguration, not the tool itself.
Linux is powerful and dangerous if you don't know what you're doing.

The Team

Meet the Fleet

11 workload agents, plus personal assistants. Each with its own Slack identity, memory, credentials, and job boundary.

💻 Phase 1 - Personal agents on repurposed Macs
JBot
JBot

HoE Assistant

Sam
Sam

CEO Assistant

↓ Personal bots became a fleet → containers, health checks, scoped credentials
🐳 Phase 2 - Docker fleet, 11 workload agents across fleet hosts
Anna Anna

Engineering

Kryten Kryten

Code Review

DonDraper DonDraper

Marketing

Pixel Pixel

Design

Jordan Jordan

Sales Ops

LotBot LotBot

CS Manager

N
Nora

Support

M
Marty

Ops

H
HawkBot

Technical

J
Jesse

Tooling

P
Poirot

Research

Why Docker Changes Everything

What happens when a bot goes rogue?

❌ Native agents, one macOS user

  • Bot reads another bot's API keys → trivial
  • Bot reads host SSH keys → trivial
  • Runaway bot kills machine → likely
  • One compromised = all compromised → yes

✅ Docker Fleet (isolated containers)

  • Bot reads another bot's keys → impossible
  • Bot reads host SSH keys → impossible
  • Runaway bot → contained (2C/2GB cap)
  • One compromised → isolated, unique creds
rm -rf / inside a container? It destroys the container. Your Mac is fine.
Reprovision in 60 seconds from the same template.

Production Architecture

Fleet hosts. 11 workload containers. Zero shared credentials.

🖥️ BOT FLEET HOSTS · APPLE SILICON · DOCKER
🌐 Slack / LAN
→
🛡️ Caddy Reverse Proxy :8080 Sole entry point · path-based routing
🐳 DOCKER · HEALTH CHECKS · SCOPED VOLUMES · NO SOCKET MOUNT
🔴 Deep access - GitHub, Sentry, AWS, codebase
🔧Anna
Engineering
🔍Kryten
Code Review
🛠️HawkBot
Technical
📋Marty
Ops
🟡 Business access - CRM, analytics, research tools
💼DonDraper
Marketing
🎨Pixel
Design
🏀Jordan
Sales
💬LotBot
CS Manager
🟢 External edge - support, webhooks, research
📨Nora
Support
🔗Jesse
Tooling
🕵️Poirot
Research
🧠 Shared Knowledge Layer

Every evening, each bot distills what it learned into a shared folder. Next morning, every other bot can search it. No orchestration. Just files.

🔐 Access Principle: Internet Exposure ↔ Internal Access

High internet exposure (CS bots reading Intercom, email) → limited internal access. Even if prompt-injected, nothing to leak.

Low internet exposure (engineering, data science) → deeper internal access. Prod read, codebase, infrastructure.

2 CPU / 2 GB per container no-new-privileges auto-restart · health check / 30s new bot in 60 seconds

The Collective Brain

The simplest architecture that produces emergent intelligence

① DAILY WORK
Each bot accumulates domain knowledge
through its normal tasks & conversations
↓
② EVENING CRON (18:00-18:25)
Staggered 5 min apart - each bot reviews
its private memory & distills highlights
↓
③ SHARED DIRECTORY
Bind-mounted into every container
Indexed by memory search automatically
↓
④ ALL BOTS CAN SEARCH
Any bot draws on the full knowledge pool
alongside its own private memories
Daily
knowledge distillation
Shared
cross-bot context
Search
before every answer
shared/knowledge/
anna-codebase-architecture.md - monorepo patterns, API contracts
kryten-infra-notes.md - CI/CD, deployment configs
pixel-agentic-ux-patterns.md - distilled from 25 research sessions
pixel-customer-voice-insights.md - from 29 calls + 40 conversations
dondraper-gtm-context.md - market positioning, messaging
nora-support-context.md - support workflows, customer patterns
No orchestration framework. No message bus. No central brain. Just a shared directory and a naming convention. Each bot writes {name}-{topic}.md.

In Action

Real screenshots from production

Anna investigating a bug in Slack

🔧 The Engineer's Nightmare

"Drawing page does not work." That's it. No page URL, no steps to reproduce, no browser info. Every engineer's least favorite bug report. Anna doesn't complain - she checks Sentry, reads the code, and asks the right follow-up questions on behalf of the team.

LotBot preparing CS meeting

💬 LotBot - With Personality

Pulls health scores from HubSpot, prepares weekly agendas in Notion. When the CEO asked "a lot at risk?" she replied: "Why do you think they brought me in? 😏"

JBot ordering groceries from Oda

🛒 "Hey JBot, order lunch"

Someone says "we need protein shakes" in #office-oslo. JBot logs into Oda, adds them to cart, and checks out. No one taught it how - it just figured out the website. Now it's the most popular team member on Fridays.

Anna replying in Swedish to a colleague

🌍 Speaks Your Language

Swedish colleague writes in Swedish, Anna replies in Swedish. Norwegian team writes in Norwegian, Anna switches. Nobody configured this - the agents just match whatever language you use.

Since March

The new use cases are less demo, more operations

🏀

Jordan owns sales plumbing

Apollo-to-Attio fallback moved from JBot to Jordan. He now owns CRM sync checks, Aircall access, and call-recording conversion.

💬

Nora became first-line support

Webhook path, customer preference lookup, Intercom thread tooling, bug handoff, deploy follow-up, and customer reply in one loop.

🔐

BankID became a workflow pattern

DNB, SEB/SAS, Furst, Gjeldsregisteret: agents handle the boring browser work and stop at approval, payment, or medical/legal judgment.

🧠

Dead history became searchable

Recordings, meeting notes, support context, and CRM fragments are getting matched back to customers instead of sitting in separate tools.

What's Next

From internal agents to product behavior

✅ Today - Internal
🖥️ FINDABLE MAC MINI
🐳 Docker Fleet
Anna
Nora
Jordan
+ 8 more
JBot LotBot Sam

All agents serve Findable employees

→
🔮 Next - Productized
☁️ FINDABLE INFRASTRUCTURE
🏢 Customer Support - Agent-assisted
Triage Root Cause Reply Drafts

Operator-gated replies · source readback

🏢 Customer Memory - Portfolio context
Meetings Documents Commitments

Verified matches · uncertain records dropped

Document agents, compliance agents, workflow agents ...
🔒

Hard boundaries

External-input agents get narrow credentials. Deep-access agents avoid untrusted customer content.

📄

Verified memory

Agents only backfill customer context when the match is strong enough to defend later.

⚡

Same fleet model

The Docker pattern works for internal bots first, then product workflows with stricter gates.

The product question is no longer "can it act?" It is "which actions deserve a human checkpoint?"

Let's connect

I'd love to hear what you build.

Johannes Berggren
LinkedIn QR

LinkedIn

/in/johannesberggren

Website QR

Website

johannesberggren.com

🚀

Try OpenClaw

Install in 15 minutes
docs.openclaw.ai

📐

The Trust Ladder

5-level framework for safe AI agent adoption - share it with your IT team

✉️ hello@findable.ai 🌐 findable.ai

This deck is still maintained the same way: edited from Slack, committed to GitHub, deployed to Vercel, and verified by the agent before anyone opens the link.