Field paper 01 · September 2026

The AI-Ready SDLC: 12 control gates from ticket to production

An evidence-backed operating guide for engineering teams using coding assistants and agents: approval controls, required records, levels of AI decision authority, pilot measures, a release worksheet, and an incident scenario exercise.

Open the 18-page PDF

The twelve gates

Frame

Name the task, owner, permitted data, expected evidence, and stopping condition before a model receives context.

Constrain

Use a context manifest. Exclude secrets, customer records, keys, unrelated repositories, and licensed code the team cannot redistribute.

Select

Choose the least-capable tool that can complete the clearly limited job inside the organization's contractual and technical controls.

Record

Capture the model, tool, material context sources, and human decision maker when the output changes production behavior.

Inspect

Review generated dependencies, licenses, transitive risk, and copied patterns before code review becomes a style exercise.

Test

Run deterministic unit, integration, and regression tests. Fluency and compilation are not acceptance criteria.

Attack

Add misuse, boundary, and adversarial cases that target the feature's data and authorization assumptions.

Review

Require a named human to understand the change, not merely approve a green pipeline.

Reproduce

Make the build and test result repeatable without depending on an inaccessible chat transcript.

Release

Attach evidence, known limitations, ownership, and a rollback trigger to the change record.

Observe

Monitor behavior, security signals, cost, failure rate, and user impact after release.

Learn

Feed incidents, false positives, prompt/context failures, and reviewer misses back into the team's controls.

The adoption decision

Do not begin with “Which coding agent should we standardize?” Begin with one change type that already has an owner, tests, review, deployment evidence, and rollback. Add AI inside that system. If the system has no evidence today, the agent will amplify the ambiguity.

See the team study