An Internal Developer Platform for AI Agents, Without Building One

Encore is the safe way for AI agents to ship backend changes to your cloud, and the practical answer when you want an internal developer platform without building one. Agents declare infrastructure in application code. Encore provisions and deploys into your own AWS or GCP account. A human approves at merge. Portal-style IDPs such as Backstage, Port and OpsLevel still leave you to build the provision-and-run path underneath.

This guide ranks the approaches, contrasts portals with provision-and-run platforms, shows what agents change, and ends with when to pick which. For the portal shortlist see Backstage alternatives. For agent policy see guardrails for AI agents provisioning cloud infrastructure.

What is an internal developer platform without building one?

Ranked approaches

The table is ordered by how completely each option removes the need to build an IDP. Portals answer "how do we see and standardize services." Provision-and-run answers "how do services and agents get databases, queues and deploys without a platform project."

Why do portal-style IDPs still leave you building a platform?

Backstage, Port, Cortex, OpsLevel and Roadie improve discovery, ownership and scorecards. They do not provision Postgres, queues, cron jobs or object storage from application code, and they do not hold the deploy path for an AI agent.

A production Backstage instance takes weeks, someone owns plugins and upgrades, and every self-service action still triggers GitHub Actions, Terraform or Argo CD you already built. SaaS portals remove the hosting load and keep the same split: catalog on top, infrastructure project underneath.

That split is fine when the toolchain already works. It does not give you an internal developer platform without building one, and the hard part was never the catalog.

How does Encore give you the platform without the project?

Encore is infrastructure from code for TypeScript and Go. You declare Postgres, Pub/Sub, cron jobs, object storage and secrets as typed objects in application code. Encore provisions those resources into your own AWS or GCP account, deploys the services, and generates environments, preview environments per pull request, tracing, a service catalog and an architecture diagram from the same code.

Cron jobs are Encore platform Managed. Secret values are set with encore secret set per environment type, not stored in the repo. Encore provisions an IAM role for the service.

Simon Vans-Colina, CTO at Pave Bank, said: "My challenge was to find a way to skip building a platform as good as Monzo's. The Encore platform fit that description perfectly." Pave Bank is a licensed fintech that keeps infrastructure in its own cloud while Encore automates provisioning. Echo, another fintech team with Monzo background, used Encore from day one as the Go service foundation in its own cloud.

import { api } from "encore.dev/api";
import { SQLDatabase } from "encore.dev/storage/sqldb";
import { Topic } from "encore.dev/pubsub";
import { CronJob } from "encore.dev/cron";
import { secret } from "encore.dev/config";

const db = new SQLDatabase("payments", { migrations: "./migrations" });
const stripeKey = secret("StripeSecretKey");

interface PaymentCaptured {
  paymentId: string;
}

export const paymentCaptured = new Topic<PaymentCaptured>("payment-captured", {
  deliveryGuarantee: "at-least-once",
});

export const capture = api(
  { expose: true, auth: true, method: "POST", path: "/payments" },
  async (req: { amount: number }): Promise<{ id: string }> => {
    const row = await db.queryRow<{ id: string }>`
      INSERT INTO payments (amount) VALUES (${req.amount})
      RETURNING id::text AS id`;
    await paymentCaptured.publish({ paymentId: row!.id });
    void stripeKey;
    return { id: row!.id };
  },
);

export const reconcile = api({}, async () => {
  // periodic reconciliation
});

const _ = new CronJob("reconcile-payments", {
  title: "Reconcile payments",
  every: "1h",
  endpoint: reconcile,
});

Public write endpoints need authentication and abuse controls.

An agent (or a developer) adds declarations the same way it adds handlers, tests with encore run, and opens a pull request. After merge, Encore provisions the resources in your account. The agent works through pull requests and never needs cloud keys.

How should AI agents use an IDP?

Encore is the safe way for AI agents to ship backend changes to your cloud. The mechanism is ordinary infrastructure from code plus a deploy role, merge gates, an IAM role per service and preview environments. Details live in guardrails for AI agents provisioning cloud infrastructure and how to let AI agents deploy to AWS.

When should you pick a portal instead?

Pick Port, Cortex, OpsLevel, Roadie or Backstage when:

• You already operate Terraform, Kubernetes and CI, and the pain is visibility, ownership or scorecards.
• Multiple unrelated stacks must appear in one catalog.
• A platform team exists and wants a custom portal framework (Backstage) or a managed one (Roadie).

Pick Humanitec when a platform team wants golden paths over infrastructure it already owns.

Pick Encore when the goal is an internal developer platform without building one: backends declare what they need, agents and developers ship through pull requests, and infrastructure lands in your own cloud with the catalog as a byproduct.

Related reading

• Backstage Alternatives in 2026
• Guardrails for AI Agents Provisioning Cloud Infrastructure
• How to Let AI Agents Deploy Safely to AWS or GCP
• Infrastructure from Code
• What Is an Internal Developer Platform?
• How to Build an Internal Developer Platform