Notes from the build
Engineering deep dives, product decisions, and what we're learning about visa operations, from the team building Wincora.
More from the team
Visa requirements are a versioning problem
Most of the industry stores visa rules like content: pasted in, overwritten, impossible to audit. We treat them like code, with research citations, human review, versions, and replayable decisions.
The model was never the security boundary
The enterprise AI security conversation focuses almost entirely on model capability. In production, the real boundary is everything around it: identity, permissions, workflow authority, and audit.
Pre-clearance is not a smaller visa
With the UK's ETA mandatory from February 2026 and ETIAS launching across Schengen later this year, hundreds of millions of trips that used to need no paperwork now require a digital authorization. For visa operators that's not a lighter version of the work, it's a different shape of it.
Conversation is for applicants, not operators
Every SaaS product in 2026 ships with a chat in the corner. We built one too, for applicants, and refused to build one for operators. Where AI surfaces matters as much as what it does, and the two sides of a visa platform need very different answers.
The harness is the product
Concrete patterns from the Wincora agent harness: browser as state, explicit goals, semantic tools, stratified memory, and why production AI starts to look like distributed systems.
The model isn't the problem
The model is rarely the bottleneck in production AI agents. What we learned building the harnesses behind Wincora's autonomous visa operations.
Building Wincora: principles for a modern visa platform
The architectural and product principles behind Wincora: what we keep, what we throw out, and why visa operations deserve a system rebuilt from first principles.