Two Apps

You're not building just one app. You're building two.

Every product ships as two systems. The user-facing one that brings value to your customers, and the internal one where your team manages the product.

module: product

The customer-facing app

[ owned by you ]

module: internal

The admin / internal tool

[ owned by Avo ]

01

the app behind the app

One app faces your customers. The other never stops changing.

The first app is the product people pay for, the public-facing one you obsess over. The second is the internal tooling behind it: the admin panels, the dashboards, the CRUD screens your team lives in every day. It's never finished. Every new model, every new team, every "can you just add a screen for this" grows it again. So while the product ships and stabilizes, the second app keeps demanding your attention forever.

No company ever won its market because the admin panel was great. Every hour on that second app is an hour not spent on the one people pay for. Build it from scratch and you carry two apps. Build it on Avo and most of the second one is already there. Already carrying an old admin? Retiring it is about a week of work, not a quarter.

02

"just have the agent build it"

You can generate the admin. Don't start from zero.

Point an agent at a blank app and it builds the same foundation every admin needs, then builds it again, a little differently, in the next app. This is what it regenerates each time, and what you review from scratch each time.

  1. SEC

    The access-control layer

    Who can load which records, who can see which attributes, who can run which actions. Scoped queries, mass-assignment protection, file and association permissions, and the same answer whether the request comes from a screen, an API call, or an agent. It's the code you can least afford to get subtly wrong, and generated fresh, it's the code you have to review hardest.

  2. BUG

    The edge cases

    Nil, empty states, pagination, timezones and DST, money rounding, every Rails association type. N+1 queries and unindexed lookups that pass in dev and fall over at real volume. Destructive operations that need a confirmation, a soft-delete, an audit trail. None of it shows up in a single-user demo, and all of it has to be prompted for, one case at a time.

  3. DEBT

    The consistency

    Every screen, and every app, ends up with its own version of the same pattern, so there's no single place to fix anything and nothing learned in the last app carries into the next. One-off dependencies bolted on per project. Upgrades that land on each admin separately, if they land at all.

  4. GAP

    The stuff you'd have to ask for

    Select-all across the whole filtered query, not just the visible page. An extra confirmation on the models that deserve one. Sane guardrails on bulk actions. These are the taste decisions that keep an admin safe to use, and they only get built if you already knew to ask.

None of this is an argument against agents. Everybody codes with them now, and so do we. It's an argument about what they build on: this foundation is the same in every app, so it shouldn't be new in every app. Avo is the foundation your agents build on.

03

the part that never shows up in the diff

The code comes fast. The steering is still yours.

Every generated screen is a prompt to write, a diff to read, a redo to run. That's your focus, and it should go to your product.

01

Tokens

Controllers, views, tables, pagination, search, and auth wiring, generated again for every app. Output you pay for, and context you don't get back for the parts that are yours.

02

Decision fatigue

Every screen is another pile of small calls to make and review. Generation got cheap, so the bottleneck became your attention.

03

Steering and redoing

Prompt, check, correct, prompt again. Experiments that go nowhere. The speed is real, and so is the time you spend directing it toward an admin instead of your product.

04

Reviewing from zero

A new admin is a new codebase to read and trust. Nothing you reviewed in the last app carries into this one, so the security review starts over every time.

05

Access control, per app

Each generated admin gets its own permission checks, its own scoping, its own gaps. The tool with the keys to everything is the one that most needs a layer that's already right.

06

Onboarding debt

Pattern-per-screen code is brutal for the next hire and the next agent session. Every screen is a new thing to learn instead of one to reuse.

04

where Avo comes in

Build on a foundation that's already there

The decisions are already made, tested in production, and hardened, and still yours to override. We use AI to move faster too, and every release is reviewed by the Avo team and vetted across hundreds of customers' apps before it reaches yours. Your agent writes a short Ruby resource on top, and it keeps working as the foundation improves underneath it.

the app you ownthe app Avo owns, filled in

Select all, the way you mean it

Select every record that matches your query, not just the rows visible on the current page. The obvious behaviour, handled correctly.

One authorization layer, every surface

Write a policy once and it holds in the CRUD UI, over the MCP server, and through the API. Scope the records a role can see and the attributes it can't, and an agent acting on your data is bound by the same rule your team is.

Confirmation where it counts

Special signage and confirmation steps for the models and actions that deserve a second look, so destructive operations don't happen by accident.

And a hundred more

From sensible defaults to the polish that improves the everyday experience, your team gets the details that make a tool feel considered rather than assembled.

And because Avo is conventional and documented, with skills shipped inside the gem, the knowledge lives in the framework, not in one person's head or one long chat. Any Rails developer, and any agent session, is productive on day one. The same foundation in every app, and one app to maintain instead of two.

✓

it comes down to three things

Time, Trust, and Taste

Time you get back

Your agents ship the second app in an afternoon instead of a sprint, and the tokens, time, and focus go to the first one.

Trust you can build on

Human-reviewed, vetted by hundreds of customers, supported by the people who wrote it, with one authorization layer on every surface.

Taste that's already there

It looks and behaves like a considered product, the same in every app, not a different generated UI each time.