AI across the SDLC — overview

• SDLC (Software Development Life Cycle) — the phases software passes through: requirements, design, implementation, testing, delivery, operations, maintenance.
• Agentic coding tool — a tool where the model plans and executes multi-step work itself: reading files, editing, running commands and tests (e.g. Claude Code, Codex CLI).
• Human-in-the-loop (HITL) — a design where a person approves or reviews AI output before it takes effect.
• Hallucination — plausible but false output, such as an API or package that does not exist.
• DORA metrics — delivery-performance measures: lead time, deployment frequency, change failure rate, time to restore.

Phase	Typical AI help	Main risk
Requirements	Summarise interviews, draft user stories, find gaps and contradictions	Confident but invented assumptions
Design	Compare options, draft ADRs and diagrams, review an architecture	Generic advice that ignores real constraints
Implementation	Completion, scaffolding, refactors, multi-file changes	Subtle bugs, inconsistent style, hallucinated APIs
Testing	Generate unit/property tests, find edge cases, triage failures	Tests that merely mirror the code
Review	PR summaries, first-pass defect and security review	False positives, missed design flaws
Delivery	Pipeline authoring, release notes, failure diagnosis	Over-trusting generated infra config
Operations	Log/alert triage, incident summaries, runbook lookup	Wrong root cause stated with high confidence
Maintenance	Legacy explanation, migrations, dependency upgrades, docs	Behavior changes during “mechanical” migration

1. Assistant — suggests; the developer decides every edit. Low risk, modest gain.
2. Agent in the loop — plans and edits across files and runs tools, under permission prompts and review of the diff.
3. Autonomous pipeline — triggered by an event (issue, failing build), produces a PR with no one watching the run. Highest leverage; needs strong tests, sandboxing and mandatory human merge approval.

Raise autonomy only as far as verification can catch mistakes: the safety ceiling is the quality of the tests and review, not the model.

• Plausible-but-wrong code that compiles and passes a shallow test.
• Context blindness — the model does not know conventions, hidden constraints or decisions that are not in the files it saw.
• Review fatigue — large generated diffs get skimmed, so defects slip through.
• Skill atrophy and ownership gaps — nobody understands code that nobody wrote.
• Data and IP leakage — pasting proprietary code or secrets into external services.

Treat model output as an untrusted contribution from a fast junior: it must pass the same gates as any other change. Fast automated checks (type checker, linter, tests, SAST) give the agent a feedback loop it can self-correct against, and give humans a floor of confidence before reading the diff.

Measure outcomes, not usage: lead time for changes, change failure rate, review turnaround, defect escape rate and developer-reported friction (DORA/SPACE-style metrics). “Lines generated” or suggestion acceptance rate is a vanity metric that rewards volume over value.