# What 1Password Learned Using AI Agents to Refactor a Monolith

# What 1Password Learned Using AI Agents to Refactor a Monolith

**Source:** https://1password.com/blog/what-we-learned-using-ai-agents-to-refactor-a-monolith
**Authors:** Nancy Wang, Wayne Duso, K.J. Valencik
**Date:** April 20, 2026

## Overview

1Password applied agentic refactoring to their B5 monolith — a multi-million-line Go codebase — to decompose services and improve system boundaries. AI agents excel at analysis and deterministic tool-building but require strong constraints for complex, interdependent changes.

## Building the Analysis Layer

The team built an agentic toolchain combining multiple analysis sources:

- Go SSA analysis for code structure
- SQL parsing for data dependencies
- DataDog MCP integration for runtime coupling metrics

This produced a domain ownership map and an extraction priority order: Vault → Billing → AuthN/AuthZ → Identity core. The approach worked because agents built deterministic tools rather than serving as ongoing interpreters. Once the tools existed, teams reasoned over stable artifacts instead of debating model interpretations.

Unexpected benefit: enhanced end-to-end transaction visibility in DataDog beyond the project's original scope.

## The Human-to-Agent Ratio

A practical migration illustrates the productivity sweet spot. The team tackled over 3,000 call sites using `MustBegin` (which panics on database failures):

1. Generated deterministic SSA-based manifests of every call site
2. Classified sites into repeatable patterns
3. Defined explicit templates for each pattern
4. Created detailed playbooks with failure modes and escalation rules
5. Ran parallel agents using git worktrees

Execution took hours; most time was spent on tooling and specification. Key insight: "When the work is fully specified and bounded, agents are both fast and accurate."

## Where Constraints Matter Most

Service extraction proved more complex. Critical failure patterns observed:

- **Sequencing errors:** Agents backfilled UUID columns before updating insertion code, causing silent data loss
- **Ownership confusion:** Treating shared tables as independently owned, creating deployment conflicts
- **Speculation:** When context was insufficient, agents filled gaps with unverified assumptions (e.g., assuming identifier format was ULID)

This work showed only 20-30% productivity improvements, indicating agents cannot replace careful coordination for interdependent decisions.

## Four Core Lessons

**Lesson 1 — Code Generation Isn't the Bottleneck.** The real challenges involve managing sequencing constraints, schema evolution, deployment order, and shared state boundaries that are difficult to reverse.

**Lesson 2 — Contain Non-Determinism.** Language model variability creates production risk. Solution: use agents to build deterministic analyzers and manifests, then constrain subsequent work to those outputs.

**Lesson 3 — Explicit Specifications Prevent Implicit Ones.** Incomplete context leads agents to make locally reasonable but globally incorrect assumptions. Specifications must include invariants, ordering constraints, and clear escalation paths.

**Lesson 4 — Parallelism Requires Solved Isolation.** Multiple concurrent agents work only when changes are independent and conflicts are structurally eliminated.

## Broader Implications

The findings highlight an emerging pattern referenced by Tido Carriero (Cursor VP of Engineering): use bigger, slower models to produce concrete plans edited by humans, then execute with smaller, faster models. This separates planning from implementation.

1Password recognizes that "AI agents are becoming a new class of actor in systems" with implications for access control and trust management. The highest-leverage engineering work shifts toward defining systems that execute safely and predictably, rather than writing code or prompting models.

## Conclusion

Agentic refactoring succeeds when problems are well-specified and deterministic tooling provides execution constraints. Engineers retain responsibility for system boundaries, dependency modeling, and sequencing correctness.