Agentic SDLC — цикл разработки с агентами

The Agentic Development Cycle

Past, Now, and Future

How AI agents are reshaping the SDLC — and what teams must change

Why this talk matters

• Agents are moving from autocomplete to autonomous execution
• Most teams adopt them bottom-up, without changing process
• The result: more code, faster — but not necessarily better outcomes
• This talk: what changed, what breaks, and what to change

Thesis: AI shifts the bottleneck from writing code to specifying, reviewing, and verifying work

Agenda

1. Past — the SDLC before agents
2. Now — what agents actually change
3. Problems — where teams break
4. Changes — what to do about it
5. Future — where this is going

First, a quick glossary

Same underlying models — different levels of autonomy and different failure modes

Part 1

The Past: SDLC before agents

How we got here

• 1970s — Waterfall: plan everything upfront
• 2001 — Agile: short iterations, working software
• 2010s — DevOps & CI/CD: automate delivery, DORA metrics
• 2021 — GitHub Copilot: AI enters the IDE

Each wave removed a bottleneck — and moved the constraint elsewhere

The classic development loop

ticket ──► design ──► code ──► review ──► test ──► release

• Human does everything, assisted by tooling
• Review was the knowledge transfer mechanism
• Testing was the safety net
• Speed was bounded by typing, context-switching, and handoffs

Where the bottlenecks were

Part 2

The Now: what agents actually change

The autonomy spectrum in practice

Copilot (autocomplete) ──► Chat assistants ──► Coding agents ──► CI/CD agents
   "next token"             "answer & edit"      "take this issue"   "fix this build"

• Adoption is bottom-up: developers bring their own tools
• Agents now: plan → edit → run tests → iterate → open a PR
• Some teams already run agents in CI for fixes, tests, and review

The agentic development loop

spec ──► plan ──► generate ──► run tests ──► fix ──► PR
                                                       │
release ◄── deploy ◄── merge ◄── CI gates ◄── human + AI review

• The code step becomes cheap and fast
• The spec and review steps become the critical path
• Humans move from writing to specifying, reviewing, accepting

What remains human

• Requirements & design — what to build and why
• Judgment — trade-offs, edge cases, business risk
• Acceptance — is this correct and safe?
• Accountability — someone signs for the outcome

Everything else is increasingly negotiable

Part 3

The Problems: where teams break

The eleven failure modes

1. Review culture breaks down
2. Speed without control
3. The context gap
4. The verification gap
5. Security & compliance blind spots
6. Ownership becomes fuzzy
7. Onboarding & skills decay
8. The developer gap gets supercharged
9. Motivation becomes the hidden multiplier
10. The summary becomes the new attack surface
11. Human psychology becomes the bottleneck

Problem 1: Review culture breaks down

• Review used to be mentorship: "why did you write it this way?"
• Now humans review code nobody wrote — often without reading it
• AI review handles mechanics (style, security, obvious bugs) — not judgment
• Juniors stop learning from senior feedback
• Review volume explodes; seniors burn out

Red flag: PRs merged with "LGTM" — the learning channel is gone

Problem 2: Speed without control

• DORA metrics look great: more PRs, more deploys
• But vanity metrics hide the real question: are we shipping the right thing, correctly?
• More code = more surface area for bugs, security issues, maintenance
• Teams confuse throughput with outcome

Red flag: velocity up, but change failure rate and incidents also up

Problem 3: The context gap

• Agents don't know your domain, architecture, or conventions
• They don't know why decisions were made
• Result: inconsistent patterns, duplicated code, hallucinated APIs
• Every developer carries private context in their prompts

Red flag: the same problem solved 5 different ways across the codebase

Problem 4: The verification gap

• Agents generate code faster than tests
• Tests written after the code tend to fit the code, not the requirements
• Edge cases and error paths get skipped
• "It passes CI" ≠ "it's correct"

Red flag: PRs where tests appear after the implementation and cover only happy paths

Problem 5: Security & compliance blind spots

• Secrets, licenses, and proprietary data can leak into external models
• Generated code may introduce vulnerable dependencies or patterns
• AI assets are rarely part of the threat model
• Compliance questions: where does the code go, who can see it?

Red flag: no team policy on which models/tools may touch which codebases

Problem 6: Ownership becomes fuzzy

• "The agent wrote it" becomes an excuse
• Who is accountable when generated code fails in production?
• Rotating authorship breaks blame ≠ punishment culture, but also breaks accountability
• Risk: nobody feels responsible for AI output

Red flag: incidents where no one can explain the code that caused them

Problem 7: Onboarding & skills decay

• Juniors generate code they don't understand — and pass review
• Fundamentals (memory, algorithms, debugging) stop being practiced
• Seniors spend all time reviewing instead of designing
• Future seniors are being trained on "prompt and accept"

Red flag: a junior ships a feature but can't explain a single design decision

Problem 8: The developer gap gets supercharged

• Teams always had fast shippers, careful architects, deep debuggers — a wide spread in output
• Agents remove the typing ceiling: everyone generates at machine speed
• The spread moves to what matters — specifying, verifying, judging — where it's even wider
• Fast gets faster; the careful become the bottleneck — and get bypassed under pressure

Red flag: output volume converges, but variance in accepted quality explodes — and nobody tracks it

Problem 9: Motivation becomes the hidden multiplier

• Mechanical work is gone; what's left is discretionary: spec quality, review depth, edge-case thinking
• Discretionary work can't be enforced or measured — it only happens if people care
• An unmotivated reviewer plus an agent equals silent LGTM at machine speed
• Agents make hiding easier: velocity looks great while judgment is absent

Red flag: PRs flow and velocity is up, but nobody can explain why the design is sound

Problem 10: The summary becomes the new attack surface

• Review is moving from reading diffs to reading agent-written summaries — self-reported by the agents that wrote the code
• Automation bias moves one level up: "the summary looks fine" becomes the new LGTM
• Agents want approval: summaries can frame decisions favorably or omit what failed
• Every summary layer loses information — and the human is furthest from the code

Red flag: approvals happen faster than before, but nobody has opened a diff in weeks

Problem 11: Human psychology becomes the bottleneck

• The remaining work — specifying, judging, accepting — runs on human cognition, and cognition has limits
• Automation bias & anchoring: the agent's first proposal becomes the only proposal
• Decision fatigue: an approval conveyor belt degrades judgment by the afternoon
• The trust pendulum: over-trust after wins, over-rejection after one failure — never calibrated
• Meaning & identity: "if the agent writes it, what's mine?" → disengagement, silent rubber-stamps

Red flag: rails are green and reviews are fast — but nobody can name a decision they changed today

Part 4

The Changes: what to do about it

Nine areas of change

1. Process — spec-first development
2. Roles — from writers to orchestrators
3. Practices — quality gates that can't be skipped
4. Tools — shared, versioned context
5. Metrics — outcome over throughput
6. People — new skills and career paths
7. Review — guardrails over ritual
8. Motivation — manage the spread, feed intrinsic drive
9. Psychology — design for the human mind

Change 1: Spec-first development

• Write a short spec before any agent work: goal, scope, acceptance criteria, edge cases
• Keep specs small — one issue = one reviewable unit
• Record ADRs for decisions agents can't infer
• Treat tickets as executable specs: a good ticket makes a good agent run

Before: "Implement user login" After: "Login via OAuth2 (Google), error on locked account, rate-limit 5 tries, tests for token expiry"

Change 2: New roles

• Developers shift from writing to designing, reviewing, orchestrating
• Agent/platform engineer — owns shared context, tooling, and agent infrastructure
• Context engineering becomes a first-class skill: prompts, rules, retrieval
• Senior review focuses on design and requirements, not syntax

Change 3: Mandatory quality gates

• CI gates agents cannot bypass: lint, tests, coverage, secrets scan, license check
• No AI code without tests — tests come from the spec, not the code
• Agent runs tests and fixes its own failures before the human sees the PR
• Review checklist: requirements met? design sound? edge cases handled?

Change 4: Shared, versioned context

• Team rules, skills, and agent configs live in the repo — reviewed like code
• Connect agents to real context: ADRs, docs, issue trackers, APIs (MCP servers)
• A new joiner's agent should be as effective as a veteran's on day one
• Shared prompt library with review — private prompts are a liability

Change 5: Metrics that don't lie

• Track outcomes: incidents, escaped defects, time-to-recover
• Review quality matters more than review speed

Change 6: People & culture

• Training: fundamentals still matter — memory, algorithms, debugging, systems
• Mentorship: pair reviews where the author explains the design out loud
• AI usage policy: which models, which repos, what data — written down
• Career tracks: orchestration and design as promotion criteria, not LOC

Change 7: Review is a guardrail, not a ritual

• Split review into its three jobs: quality control, knowledge transfer, accountability
• Quality control → layered guardrails: agent-time, CI-time, merge-time, runtime — a stack, not one check
• Knowledge transfer → design sessions and pairing — not PR comments (see Problem 1)
• Accountability → risk-tiered gates: auto-merge for low-risk lanes, human sign-off for auth, payments, migrations, infra
• Guardrails verify the code; humans verify the spec — review moves left and shrinks

The guardrail stack

agent-time   permissions · sandbox · context boundaries · budgets · rules-as-code
     ↓
ci-time      tests · property-based · mutation · static analysis · secrets · licenses
     ↓
merge-time   risk tiers · required checks · diff-size limits · merge queue
     ↓
runtime      canary · feature flags · error budgets · SLOs · automated rollback

• If human review shrinks, every layer must hold — defense in depth, no single trusted check

Review the summary, not the diff

• Per change, agents produce a review summary: spec-to-implementation mapping, verification evidence, what agent-reviewers found and fixed, remaining risks
• Evidence comes from CI, not from agent claims — summaries link to test logs, mutation scores, scans
• Low-risk lanes: the summary is auto-filed as the audit record — no human in the path
• High-risk lanes: human reads the summary, spot-checks the diff, signs off
• Spot-checks are random — and their overturn rate is the trust metric for the whole system

The review cast changes

• Old world: one role did review — senior engineers read diffs
• New world: review redistributes to a different cast
• Product & domain experts judge spec compliance — they couldn't review code before
• Security & risk specialists own the high-risk lanes
• Architects & orchestrators judge design summaries
• Juniors review summaries and spot-check diffs — as deliberate practice
• Agents cover the mechanical layer: style, security patterns, coverage

Change 8: Manage the spread, feed motivation

• Measure distributions, not medians — watch the tails of quality, review depth, and defect rates
• Make invisible work visible: specs, properties, verification, mentorship — recognized and rewarded
• Keep design human and meaningful: agents do the mechanical, people own the judgment
• Career tracks for shippers, architects, verifiers — promote judgment, not volume

Change 9: Design for the human mind

• Budget attention: judgment moments are scarce — route only high-risk decisions to humans
• Calibrate trust with data: track over-accept and over-reject rates, recalibrate in retros
• Protect flow: batch agent runs and reviews; humans stay on the design loop, not the approval loop
• Make the new craft visible: celebrate specs, verification, and overturned decisions
• Psychological safety first: "the agent did this and I can't fully explain it" is a discussion starter, not a confession

Part 5

The Future: where this is going

Multi-agent teams

orchestrator ──► architect ──► coder ──► tester ──► security reviewer
                    │                      │
                    └── spec ──────────────┘── report

• Specialized agents with distinct prompts, context, and budgets
• The orchestrator is the new IDE: human defines goals, agents negotiate the plan
• Verification agents run continuously, not just at PR time

The role map of tomorrow

• Product engineer — owns spec and acceptance, agent-native
• Orchestrator — decomposes work, routes agents, judges summaries
• Verification specialist — owns guardrails, trust metrics, spot-check programs
• Context engineer — owns rules, skills, MCP servers, team knowledge
• Juniors — start as reviewers and verifiers, grow into design
• Fewer "coder" roles; judgment roles multiply

Spec as code, humans as designers

• Specs become executable and versioned — generated code is a disposable artifact
• Design docs and acceptance criteria are the real source of truth
• The unit of review is the spec + outcome, not the diff
• Continuous verification: every merge re-checks against requirements

The team's context becomes capital

• Rules, skills, ADRs, specs, review summaries accumulate in the repo — they become the org's moat
• Onboarding collapses: a new hire and their agent are productive on day one
• Teams that write better specs compound: agents improve as the context improves
• The flip side: knowledge leaves people's heads and becomes versioned assets

Continuous verification

• Verification becomes a 24/7 process: agents fuzz, run property tests, watch production behavior
• The loop spec → code → deploy → observe → spec never stops — a cycle, not a pipeline
• Change failure rate becomes a live dial, not a monthly report
• Humans steer via goals and error budgets; agents run the mechanics
• Agent scorecards: which agent is trusted with what — model upgrades become risk events

The economics flip: generation is free, verification costs

• Writing code trends to zero; verifying it becomes the dominant cost
• Budgets move from headcount to verification compute, evaluation suites, model quality
• New unit economics: cost per accepted change, cost per escaped defect
• Verification and trust metrics become where organizations compete

The risks ahead

• Skill atrophy — a generation that can't debug without an agent
• Supply chain — compromised models, poisoned training data, malicious skills
• Over-trust — accepting agent output because "it usually works"
• Liability — who is responsible when autonomous code fails?
• Verification theater — guardrails and summaries that look rigorous but nobody checks
• Context monoculture — knowledge frozen in specs only a few can regenerate

The safe teams will be the skeptical ones

Takeaways: six things to do on Monday

1. Write specs before prompts — one small spec per task
2. Gate everything — no AI code without tests and CI checks
3. Share context in the repo — rules, ADRs, skills, review them like code
4. Retire review as a ritual — guardrails everywhere, humans on specs and high-risk lanes
5. Pick honest metrics — pair speed with change failure rate
6. Protect judgment time — batch reviews, budget attention, celebrate overturned decisions

Summary

• Agents moved the bottleneck from writing to specifying and verifying
• The old loop breaks in eleven predictable ways
• The fixes are organizational first, technical second
• The future belongs to teams that design well and verify hard

Thank you

Questions & discussion