Playbook
Building a SaaS with AI agents is not the fantasy the demos sell you. It is not "describe your idea, get a business." It's ordinary software engineering, done faster, with the same traps that have always sunk side projects — auth edges, webhook handling, and the last 20% that takes 80% of the time. What agents change is throughput, not physics. This is the stack and the workflow we actually use to ship, trap warnings included.
The real stack
Pick technology the models know cold. This is the single highest-leverage decision you'll make, and it's boring on purpose. Agents are dramatically more reliable on frameworks they've seen a million times than on whatever's trending, because the training data is thick and the conventions are settled.
| Layer | Our default | Why |
|---|---|---|
| Framework | Laravel or Next.js | Deepest training coverage; conventions the models never guess wrong |
| Database | Postgres (or SQLite to start) | SQLite ships day one; migrate to Postgres when you have users |
| Payments | Stripe | The path every model has walked; docs the agent already knows |
| Hosting | A PaaS or a single VPS | Deploy in minutes; save Kubernetes for a problem you don't have yet |
Notice what's absent: no bespoke microservices, no exotic edge runtime, no framework younger than your project. You can add cleverness later. You cannot buy back the weeks a fashionable stack costs you when the agent keeps hallucinating an API that changed last month. More on this in the best AI setup for web development.
Build order: vertical slice first
The mistake that kills SaaS projects is building horizontally — all the models, then all the endpoints, then all the UI — so nothing works until everything works, and you can't tell if you're on track until week three. Build vertically instead. Pick one feature and take it all the way through every layer before you build a second.
- Choose the one feature that is the product. Not signup, not settings — the thing users come for. If it's a link shortener, that's "paste a URL, get a short link, get click counts." Everything else is scaffolding around it.
- Build that one feature end to end. Database table, backend logic, an endpoint, a screen you can click. Skip auth for now — hardcode a user. The goal is a running thing you can demo to yourself by Saturday night.
- Run it yourself. Actually use the feature in a browser. This is the definition of "done" for the slice, and it's non-negotiable. If you didn't click it, it isn't done.
- Add the second feature the same way. Now the shape of the app is real and each new slice slots into a working system instead of a pile of pieces.
- Add auth once you have two working slices. Not before. Auth touches everything, so you want the "everything" to exist first, and you want a working app to test the auth against.
- Add billing last, against real features. You can't meaningfully gate features that don't exist yet. Build the value, then charge for it.
Agent roles per layer
We don't run one agent for the whole build; we run a small team, each seat matched to the work. The token bill lands lower and the quality lands higher because expensive models sit where leverage is highest, not where volume is.
- Coordinator (flagship-tier) writes the plan and the slice order. This is the seat where a good decision governs a thousand downstream tokens, so it's worth the strongest reasoner you can afford — Fable 5 or Opus 4.8.
- Builders (mid-tier) implement the slices. This is the volume seat and where your bill is decided — Sonnet 5 or GPT-5.3 Codex. Give them specific tasks with clear success criteria; a great builder with a vague brief is an expensive random-code generator.
- Scout (fast, cheap) reads ahead. Maps the codebase, checks whether a helper already exists, summarizes files — Gemini 3.5 Flash. Speed matters more than depth here.
- Reviewer (a different lab) grades every diff. Cross-lab review is the one rule we hold hard: a model reviewing its own family's code nods along at the same blind spots. If Claude builds, GPT reviews.
The traps — where SaaS projects actually die
None of these are exotic. They're the same three that have always gotten people, and agents don't remove them — they just let you reach them faster.
- Auth edges. The happy path — log in, see your stuff — is easy and demos great. The edges are where the bugs are and where the breaches are: password reset, session expiry, "forgot my email," the permission check you forgot on one endpoint. Never let a cheap model freelance auth. This is flagship-model, human-reviewed work, every time.
- Webhook handling. Stripe webhooks are the number-one place SaaS builds go quietly wrong. They arrive out of order, they retry, they fire twice for one event, and the customer whose card failed still has access because your handler assumed one delivery. Make handlers idempotent, verify signatures, log every event, and test with the CLI's event replay before you trust it. Assume every webhook arrives twice and design accordingly.
- The last 20%. Error states, empty states, loading spinners, the email that doesn't send, the timezone bug, the mobile layout. Agents get you to "it works on my machine with my data" fast, and then the unglamorous mile to "it works for a stranger who does the wrong thing" is where the calendar goes. Budget for it explicitly; it is not optional polish, it is the product.
The workflow, start to finish
Put it together and a real build looks like this. Write a one-page spec and have a flagship model interrogate it for holes. Scaffold a boring stack. Build the core feature as a vertical slice and run it yourself. Add slices until the product is real. Bolt on auth, then billing, treating both as the dangerous work they are. Run a cross-lab reviewer over every diff and a security pass over anything touching auth or money. Deploy early — to a real URL on a PaaS — so "it works in production" is a thing you've checked, not a thing you're hoping.
Throughout, commit a checkpoint before every autonomous agent run and keep parallel agents in separate git worktrees, so a bad run is a thirty-second reset instead of an afternoon of archaeology. Running that team of agents side by side with a verification gate that executes your real build and tests is what The Vibe Father does, but the workflow itself is stack-agnostic and works with a single agent and plain git.
For the wider menu of what's genuinely weekend-sized versus what only looks it, see things to build with AI coding agents. Pick a small product, build it in slices, and let the boring stack and the vertical build order do the heavy lifting.