Free guide

Ship with AI coding agents, safely

An adoption framework for an AI-assisted software delivery lifecycle (AI-SDLC). It is the process behind more than 5,000 merged pull requests on two production platforms.

What's inside

1. 1. Write the guardrails first

   • A short instruction file per repository: architecture, conventions, what the agent may and may not do.
   • Hard rules: authentication, payments, data deletion and secrets always need a human approval.
   • Agents never touch production data or real customer accounts, only test accounts.

2. 2. Keep every change small and reversible

   • One ticket, one pull request. Branch protection and a PR-only workflow, no direct pushes.
   • Database migrations idempotent and dry-run against the target database before merge.

3. 3. Staging first, always

   • Every change reaches a staging environment before production, with the same build and config.
   • Only changed functions or services are deployed, to keep each release small.

4. 4. Verify like a user

   • Unit and end-to-end tests, plus type-check and lint baselines that can only improve.
   • An AI browser test in a real Chrome: the flow described in plain language, a pass or fail with errors and a fix prompt.

5. 5. Analyse the impact before production

   • A short table per release: what changes, who is affected, the risk and the way back.
   • A human approves the production merge.

6. 6. Ship and watch

   • Smoke tests on vital routes after every deploy, and the deploy turns red if one breaks.
   • Outcome monitoring, and one issue opened automatically per failure, closed when it recovers.

7. 7. Close the loop

   • Customer replies drafted by the agent and sent by a person.
   • Every lesson goes back into the instruction files, so the process improves itself.

8. Rolling it out, by company size

   • Startup: guardrails, staging and browser checks in one to two weeks. Speed comes from the loop, not from skipping it.
   • Mid-sized company: one pilot team for four to six weeks, a security review, then the rollout to the other teams.
   • Enterprise: governance first: an approved model and provider list, data classification, local models for sensitive code, an audit trail and a platform team that enables the others.

9. What to measure

   • Lead time from ticket to production, change failure rate, merged pull requests per week and bugs found by users.