# AI SDLC Playbook: The Operating Model for AI Delivery > The hub for AI in the software development lifecycle: ten operating rules, three eras of AI, and where each phase gets help or fails. Source: https://aidlc.guru/playbook/ --- The Operating Model # The AI SDLC Playbook AI in the software development lifecycle is an operating model change, not a tooling purchase. Authoring code got cheap. Verification, integration, and merge capacity are now the constraint, and this is the operating manual for the rules, roles, and guardrails that make the gain durable instead of a spike that reverses. ![A glowing strategy board with play diagrams moving people and AI agents across the field](https://aidlc.guru/images/pages/playbook.png) ## Why This Is an Operating Model Problem Licenses were never the hard part. Once an agent can produce a working diff in minutes, the bottleneck moves downstream to whoever has to read, verify, and merge it. Organizations that redesign review, testing, and merge capacity around that constraint capture a real gain. Organizations that bolt agents onto the existing authoring step just double their pull request volume and drown in it. That is the thesis behind every page in this Playbook. It is not a claim that AI does not help - it demonstrably does at the level of a single task. It is a claim that individual acceleration does not automatically become organizational throughput, and that the difference between the two outcomes is deliberate operating design, not the model you picked. Software development has already moved through three eras of AI assistance, each shifting more of the work to the agent and more of the job to the human who directs and checks it. The rest of this guide is an operating model for the era the industry is in now. ## Ten Rules 1 ### An operating model change, not a purchase Licenses are the cheapest and least important part of putting AI into the SDLC. 2 ### Authoring is cheap. Verification is the constraint. Design review, test, and merge capacity before you scale how much code gets generated. 3 ### Individual output is not organizational throughput Every serious dataset since 2024 shows the gap. Assume it applies to you until your own numbers say otherwise. 4 ### Governance before scale Retroactive policy lands after habits have formed and costs more to enforce. 5 ### Baseline before adoption A number without a pre-AI baseline is a story, not evidence. 6 ### Measure outcomes, not activity Cycle time, change failure rate, escaped defects, and review latency. Not adoption percentage, not AI-authored lines. 7 ### Humans own merges An agent never holds merge authority on a protected branch. Every production change has a named human approver. 8 ### Hold AI code to the human bar, with more suspicion AI output is plausible by construction. Plausible is not correct. 9 ### Agents are services They get an identity, a permission scope, a sandbox, a budget, and hard rules, same as any other workload. 10 ### The compounding asset is your context, not the model Repo instructions, review rules, skills, evals, fixtures, and evidence are owned. Models are rented and will be swapped. ![Checklist of ten rules, from Operating model change and Verify, not author to Humans own merges and Own your context.](https://aidlc.guru/images/figures/playbook-ten-rules.png) ## Three Eras of AI in Software Development Era Window What it looks like Developer role Unit of trust Autocomplete 2021 to 2023 Keystroke-level suggestions, tab to accept (Copilot preview June 2021, general availability June 2022) Full control of every line The line Synchronous agents 2023 to 2025 Chat and agentic IDE loops, one task at a time, human watching (ChatGPT, Cursor, Claude Code, Copilot Chat) Human in the loop, directing The diff Autonomous agents 2025 onward Agents run for hours in CI and cloud sandboxes, open pull requests unattended, run in parallel fleets (Copilot cloud agent, Codex cloud, Claude Code GitHub Action, background agents) Defines problems, approves plans, reviews artifacts and evidence The plan and the evidence pack ### What Changed in 2025 and 2026 - Agents moved into CI. GitHub's [Octoverse 2025](https://github.blog/news-insights/octoverse/octoverse-a-new-developer-joins-github-every-second-as-ai-leads-typescript-to-1/) report found the Copilot coding agent (renamed cloud agent in April 2026) authored over one million pull requests between May and September 2025. - By March 2026, [GitHub reported](https://github.blog/ai-and-ml/github-copilot/60-million-copilot-code-reviews-and-counting/) more than one in five code reviews on GitHub was a Copilot review, 60 million in total. By September 2026 GitHub was previewing AI review approvals that count toward required reviews. - Vendors now report a majority of their own code as AI-authored. Anthropic said more than 80 percent of code merged to production in May 2026 was authored by Claude. Google said more than 30 percent of its code was created with AI help in April 2025. Treat both as self-reports with different definitions - assisted versus autonomous, written versus merged. - Era 2 practice, where a human reads every line, does not scale to Era 3 volume. Era 3 practice - plan approval, risk-tiered review, generated evidence, mutation-scored tests - is not yet common. Most organizations are running Era 3 tooling with Era 2 process, and that gap is where the [common failure patterns](https://aidlc.guru/failure-patterns/) live. ![Three steps rising from Era 1 Autocomplete to Era 2 Synchronous agents to Era 3 Autonomous agents.](https://aidlc.guru/images/figures/playbook-three-eras.png) ## Where AI Touches Every Phase Risks and guardrails are phase-specific. A blanket policy either over-restricts or under-protects. Phase Strong at Weak at Guardrail Who owns the outcome Requirements and design [Analyze](https://aidlc.guru/phases/analyze/) / [Ideate](https://aidlc.guru/phases/ideate/) Drafting PRDs, stories, acceptance criteria, design options, architecture notes, ambiguity checks against a spec Knowing what the business actually wants; tradeoffs it was never told about The ticket becomes a machine-readable contract (see [Templates](https://aidlc.guru/templates/)); a human signs the intent Product owner Coding [Develop](https://aidlc.guru/phases/develop/) First drafts, boilerplate, tests, migrations, refactors with a clear target, unfamiliar APIs Your actual edge cases, your architectural conventions, current API versions, production-grade error handling Repo instruction file, plan approval before implementation, small pull requests Author (human or named agent identity) Code review [Develop](https://aidlc.guru/phases/develop/) First pass: formatting, naming, anti-patterns, obvious security flags, PR summaries, risk classification Judgment calls needing domain or architectural context; knowing which rule matters here Versioned review standards, risk-tiered routing (see [AI Code Review at Scale](https://aidlc.guru/code-review/)), human approver required Reviewer Testing [Launch](https://aidlc.guru/phases/launch/) Unit tests, fixtures, edge-case enumeration, Playwright specs from acceptance criteria, contract tests Tests that assert the right thing. AI writes tests that look thorough and assert nothing Mutation testing on critical modules; coverage is not the gate, mutation score is QA lead CI/CD [Launch](https://aidlc.guru/phases/launch/) Pipeline config, build failure diagnosis, release notes, infra snippets, safe-class auto-repair Anything where the cheapest path to green is weakening a test Agent identity, hard rules (see [Agents in the Pipeline](https://aidlc.guru/agents-in-the-pipeline/)), attempt limits, original failure log attached Platform team Release [Launch](https://aidlc.guru/phases/launch/) Change records, risk diffs, impact matrices, rollback plans, control mapping generated from the branch Deciding whether to ship Named human approver on every production merge Release owner Incident response [Curate](https://aidlc.guru/phases/curate/) Alert synthesis, log condensation, correlating deploys to errors, drafted status updates, timeline reconstruction Deciding what to do under uncertainty; customer communication Agent proposes, human acts; drafts are labeled as drafts Incident commander Postmortems [Curate](https://aidlc.guru/phases/curate/) Timelines, summaries, draft action items, pattern matching against past incidents Blameless framing, organizational truth Every escaped defect becomes a review rule (see [Engineering Practices](https://aidlc.guru/engineering-practices/)) Engineering manager Maintenance [Curate](https://aidlc.guru/phases/curate/) Dependency bumps, deprecation fixes, copy and internationalization, test backfill, documentation Long-horizon structural refactoring; it will not do this unless told Scheduled refactoring budget; track cross-file coupling and duplication Tech lead ## Start Here by Role Everyone needs the ten rules above. Past that, start where your role sits. ### CTO, VP Engineering Read [The AI-Native SDLC](https://aidlc.guru/ai-native-sdlc/), [The Productivity Paradox](https://aidlc.guru/productivity-paradox/), the [Maturity Model](https://aidlc.guru/maturity-model/), [Governance Before Scale](https://aidlc.guru/governance/), [Measuring Impact](https://aidlc.guru/measuring-impact/), the [Cost Model](https://aidlc.guru/cost-model/), and [Failure Patterns](https://aidlc.guru/failure-patterns/). ### Engineering managers, staff engineers Read [Engineering Practices](https://aidlc.guru/engineering-practices/), [AI Code Review at Scale](https://aidlc.guru/code-review/), [Agents in the Pipeline](https://aidlc.guru/agents-in-the-pipeline/), [Agent Orchestration](https://aidlc.guru/agent-orchestration/), [Security and Compliance](https://aidlc.guru/security-and-compliance/), and the [Rollout Playbook](https://aidlc.guru/rollout-playbook/). ### Individual contributors Read [Engineering Practices](https://aidlc.guru/engineering-practices/), [Agents in the Pipeline](https://aidlc.guru/agents-in-the-pipeline/), and [Templates and Checklists](https://aidlc.guru/templates/) for the day-to-day patterns. ### Security, compliance, audit Read [Governance Before Scale](https://aidlc.guru/governance/), [Security and Compliance](https://aidlc.guru/security-and-compliance/), and [Templates and Checklists](https://aidlc.guru/templates/). ### Anyone about to quote a number Read the [Research Library](https://aidlc.guru/research/) first. Several widely circulated AI productivity figures are misattributed, and [The Productivity Paradox](https://aidlc.guru/productivity-paradox/) is the single most misquoted finding in this field. ### Enterprise and solution architects Read [How the Phases Connect](https://aidlc.guru/how-the-phases-connect/) for the handoffs and owners, [Testing Strategy](https://aidlc.guru/testing-strategy/) for where each test lives, and [Building AIDLC Into an AI Engine](https://aidlc.guru/ai-engine-integration/) for the reference architecture. ## The Playbook Nineteen pages, each covering one part of the operating model in depth. [ ### The AI-Native SDLC Seven pillars: context and measurement first, then five workflow shifts from planning to maintenance. ](https://aidlc.guru/ai-native-sdlc/)[ ### The Productivity Paradox Faros, DORA, and METR data on why individual speed does not equal organizational throughput. ](https://aidlc.guru/productivity-paradox/)[ ### Hidden Risks The risk table behind AI-authored code, with CodeRabbit, GitClear, and security research. ](https://aidlc.guru/hidden-risks/)[ ### Maturity Model Levels 0 through 4, plus an interactive self-assessment for where your team stands. ](https://aidlc.guru/maturity-model/)[ ### Governance Before Scale Five pillars, a policy outline, and a vendor evaluation checklist. ](https://aidlc.guru/governance/)[ ### Engineering Practices Context engineering, the ticket contract, plan-first work, mutation testing, and the merge queue. ](https://aidlc.guru/engineering-practices/)[ ### AI Code Review at Scale The review layer, versioned standards, reviewer fatigue, and measuring review quality. ](https://aidlc.guru/code-review/)[ ### Agents in the Pipeline Identity, permissions, sandboxing, budget, and hard rules for agent workloads. ](https://aidlc.guru/agents-in-the-pipeline/)[ ### Agent Orchestration The state machine, dual review, and provable gates that conduct a whole fleet of agents. ](https://aidlc.guru/agent-orchestration/)[ ### Security and Compliance The OWASP threat model, data classification, and framework mapping. ](https://aidlc.guru/security-and-compliance/)[ ### Measuring Impact Baseline first, the metrics to report, the metrics to ignore, and the paradox test. ](https://aidlc.guru/measuring-impact/)[ ### Cost Model and Build vs Buy Three cost buckets, unit economics, and four build-versus-buy positions. ](https://aidlc.guru/cost-model/)[ ### Failure Patterns Twelve common ways AI-assisted delivery goes wrong, and how to spot each one early. ](https://aidlc.guru/failure-patterns/)[ ### Rollout Playbook Phase 0 through phase 3, each with its own exit criteria. ](https://aidlc.guru/rollout-playbook/)[ ### Scrum and Kanban Sprint events, review-based estimation, WIP limits on review, and a Definition of Done for agent work. ](https://aidlc.guru/scrum-and-kanban/)[ ### Teams and Skills How roles shift, how juniors still learn, interviewing and upskilling. ](https://aidlc.guru/teams-and-skills/)[ ### Legacy Code Characterization tests first, strangler fig slices, and safe upgrades on brownfield systems. ](https://aidlc.guru/legacy-code/)[ ### Templates and Checklists The policy outline, ticket contract, PR template, reviewer checklist, and vendor checklist. ](https://aidlc.guru/templates/)[ ### Research Library Every primary source behind this Playbook, with its key finding, in one place. ](https://aidlc.guru/research/) ## Where It Fits in AIDLC The Playbook is not a sixth phase. It is the operating layer underneath all five. [Analyze](https://aidlc.guru/phases/analyze/) and [Ideate](https://aidlc.guru/phases/ideate/) apply the ticket contract and the signed intent from requirements and design; [Develop](https://aidlc.guru/phases/develop/) runs the agent identity, review, and merge rules from coding and code review; [Launch](https://aidlc.guru/phases/launch/) applies the testing, CI/CD, and release guardrails; [Curate](https://aidlc.guru/phases/curate/) turns incidents, postmortems, and maintenance work back into the next review rule. The table above breaks down exactly where each phase is strong, where it is weak, and who owns the outcome. ## Frequently Asked Questions The AI SDLC Playbook is an operating model guide to putting AI into requirements, coding, review, testing, CI/CD, release, and operations without trading long-term system health for short-term output. It covers ten operating rules, three eras of AI in software development, and nineteen linked pages on transformation, governance, engineering practices, review, orchestration, security, cost, rollout, teams, and legacy code. The five AIDLC phases, Analyze, Ideate, Develop, Launch, and Curate, describe where work happens in a project. The Playbook describes how to operate once agents do meaningful work inside each phase: what gets verified, who approves what, and which guardrails apply. The phases are the map; the Playbook is the operating manual for the parts of the map where AI now participates. Start with the ten rules and the three eras table on this page, then open the card for your role: CTO or VP Engineering, engineering manager or staff engineer, individual contributor, security and compliance, or enterprise and solution architect. Anyone about to cite a productivity number should read the Research Library and the Productivity Paradox page first. ## Move From Rules to Practice The ten rules above are necessary but not sufficient. See what the productivity data actually shows, then go deeper into the AIDLC phases where agents now do real work. [The Productivity Paradox](https://aidlc.guru/productivity-paradox/) [Learn AIDLC](https://aidlc.guru/learn/)