# AI SDLC Rollout Playbook - Baseline, Assist, Delegate > A four-phase timeline for rolling out AI-assisted engineering: baseline in three weeks, assist, delegate, and compound - with exit criteria for each phase. Source: https://aidlc.guru/rollout-playbook/ --- Rollout # The AI SDLC Rollout Playbook Generic phasing you adjust to team size and regulatory weight - a regulated team should expect every phase to run longer. The promise is a published baseline in three weeks and a first measured delta at 90 days, not a velocity multiple in the first 60 days. ![A winding road from a base camp past four milestone flags to a glowing summit](https://aidlc.guru/images/pages/rollout-playbook.png) ## Why the Phases Overlap None of the four phases below has a hard stop. Phase 1's plan-first review keeps running through Phase 2 and Phase 3; Phase 2's Lane B agents do not replace the pre-review rules Phase 1 built, they run on top of them. Each phase adds a capability without retiring the ones before it, which is why the exit criteria matter more than the calendar - a team that hits Phase 1's numbers in six weeks should move on, and a team that has not published a baseline should not be running unattended agents no matter what month it is. What compounds is not the tooling - it is the organization-specific material the tooling produces: review rules learned from your own escaped defects, eval fixtures built from your own incidents, an evidence pack shaped by your own audit requirements. A competitor can buy the same agents. They cannot buy three quarters of your review rules. ## The Timeline ### Phase 0. Baseline and Configure Weeks 1 to 3 Measure where you stand and set the guardrails before agents touch anything. ### Phase 1. Assist Months 1 to 3 Agents draft and pre-review inside the existing loop; a human still owns every merge. ### Phase 2. Delegate Months 2 to 5 Unattended agents take the safe work class; the learn loop starts turning defects into rules. ### Phase 3. Compound Months 5 to 9 Evidence, domain pipelines, and quarterly upgrades turn accumulated rules into a moat. ![Staggered timeline: Phase 0 Baseline and Configure Weeks 1 to 3, Phase 1 Assist Months 1 to 3, Phase 2 Delegate Months 2 to 5, Phase 3 Compound Months 5 to 9.](https://aidlc.guru/images/figures/rollout-playbook-timeline.png) ## Phase 0. Baseline and Configure (Weeks 1 to 3) The goal is a number, not a vibe. Instrument the pipeline and settle the policy and access model while the stakes are still small - everything that follows gets measured against what this phase publishes. - Approved tool list, company-managed accounts, and training opt-out confirmed in writing. - An [AI usage policy](https://aidlc.guru/governance/) written and communicated. - Data classification mapped to AI surfaces, per [security and compliance](https://aidlc.guru/security-and-compliance/). - API platform org and service identity for CI set up, with [budgets and caps](https://aidlc.guru/agents-in-the-pipeline/) in place. - Seat mix rebalanced toward premium tiers for heavy agent users. - Repo hygiene: root and per-package instruction files, CODEOWNERS, and the [ticket contract and PR templates](https://aidlc.guru/templates/). - Baseline instrumentation: cycle time, review latency, change failure rate, escaped defects, deploy frequency, and mutation score on critical modules. ### Exit Criteria The baseline is published. Cost incurred so far: seats only. ## Phase 1. Assist (Months 1 to 3) Agents assist inside the existing loop - drafting plans, pre-reviewing, generating tests - while a human is still in the loop of every merge. - Plan-first review on all non-trivial tickets, per [engineering practices](https://aidlc.guru/engineering-practices/). - Risk-tiered routing live, so higher-risk changes get more scrutiny automatically. - AI pre-review with a first set of org-specific rules, run through the eval fixture set - see [AI code review at scale](https://aidlc.guru/code-review/). - Generated tests from acceptance criteria on new work. - A merge queue in place. - AI-drafted release notes and change records. ### Exit Criteria Review latency down materially (40% is a reasonable target), QA cycle time down, and change failure rate flat or better. ## Phase 2. Delegate (Months 2 to 5) The safe work class moves to unattended agents, and the learn loop starts running on its own cadence instead of waiting for a retrospective. - [Lane B unattended agents](https://aidlc.guru/agents-in-the-pipeline/) on the safe work class only. - Bug-to-failing-test automation. - Pipeline auto-repair on the safe failure class. - Contract tests for external adapters against recorded fixtures. - Learn loop running: escaped defects become review rules on a weekly cadence. ### Exit Criteria 20 to 30 percent of merged PRs are agent-originated; change failure rate and incidents per deploy are unchanged; Lane B's cost per merged PR is below the human-loaded cost for that work class. ## Phase 3. Compound (Months 5 to 9) Evidence generation and domain-specific pipelines become routine, and the rules, skills, fixtures, and evidence accumulated so far start compounding. - An [evidence pack](https://aidlc.guru/security-and-compliance/) generated on every release. - Domain-specific pipelines - for a regulated product, a rule change becomes a config diff, tests, and evidence, with humans adjudicating. - An incident agent on call, proposing and drafting, never acting alone. - Quarterly model and rule upgrades run through the eval suite. ### Exit Criteria There is no fixed exit here. This is the phase that becomes a moat, because the review rules, skills, fixtures, and evidence are specific to your organization and compound every quarter. ## What to Promise Leadership Do not promise a velocity multiple in the first 60 days - that number will not exist yet, and promising it invites a broken measurement to fill the gap. Promise a published baseline at three weeks, which is Phase 0's exit criterion, and a first measured delta at 90 days, once Phase 1 has had time to move review latency, QA cycle time, and change failure rate. See [Measuring Impact](https://aidlc.guru/measuring-impact/) for what belongs in that 90-day readout and which metrics to leave out of it. ## Small Teams and Solo Builders The timeline above assumes an organization with a platform team, a compliance function and enough engineers to staff two reviewers. A team of one to ten has none of that, and does not need most of the ceremony. It still needs the controls that stop an agent from shipping a mistake, because a small team has less slack to absorb one. ### Keep, even at one person - A one-page [usage policy](https://aidlc.guru/templates/#usage-policy) - mostly which data never goes into a prompt. - A [repo instruction file](https://aidlc.guru/templates/#repo-instructions), updated every time an agent repeats a mistake. - Plan first, then diff. Reading a plan takes a minute and catches the expensive errors. - Tests before merge, and a mutation check on the code that handles money, auth or customer data. - Small batches and a rollback path - a feature flag or a one-command revert. - A baseline you can get for free from git history: lead time and how often a change had to be fixed or reverted. ### Skip or shrink until you grow - Governance committees and ownership models - the owner is whoever merges. - Full vendor scorecards - the [eight binary vendor questions](https://aidlc.guru/governance/#eight-vendor-questions-with-binary-answers) are enough. - Merge queues and per-release evidence packs, unless a customer or regulator asks for them. - Quarterly surveys - just talk to each other. - Unattended Lane B agents, until the baseline exists and the tests are trustworthy. **The one hard problem is the second reviewer.** A solo builder cannot have one for every change, so spend review where the risk is: Tier 1 and Tier 2 changes get your own review of the agent's diff after a break, with fresh eyes; Tier 3 changes - authentication, payments, data deletion - get an outside reviewer or a test suite you would bet the business on. An AI reviewer is a useful extra layer, but it is a second opinion, not an approver. Phase 0 compresses from weeks to a few days, and the rest of the timeline compresses with it. ## Where It Fits in AIDLC The rollout playbook is not a sixth phase - it is the adoption curve running underneath all five. Phases 0 and 1 mostly touch [Analyze](https://aidlc.guru/phases/analyze/) and [Ideate](https://aidlc.guru/phases/ideate/) work through plan-first review and pre-review; Phase 2 pushes further into [Develop](https://aidlc.guru/phases/develop/) and [Launch](https://aidlc.guru/phases/launch/) as unattended agents take on real work; Phase 3's evidence packs and learn loop feed [Curate](https://aidlc.guru/phases/curate/), closing the loop that lets the next quarter compound. ## Related Pages [ ### Maturity Model The levels these phases are designed to move you through. ](https://aidlc.guru/maturity-model/)[ ### Measuring Impact What to report at the 90-day mark, and what to leave out. ](https://aidlc.guru/measuring-impact/)[ ### Governance Before Scale The policy work Phase 0 depends on. ](https://aidlc.guru/governance/)[ ### Failure Patterns Twelve ways a rollout goes wrong, and at which phase. ](https://aidlc.guru/failure-patterns/)[ ### Learn the Framework Put all five phases into practice. ](https://aidlc.guru/learn/) ## Frequently Asked Questions A generic rollout runs about nine months across four phases: a three-week baseline, three months of assisted review, two to five months of delegated work on safe tasks, and an open-ended compounding phase after that. Team size and regulatory weight change the durations - a regulated team should expect longer phases and more evidence work throughout. Phase 0 delivers a published baseline, not a pilot result. That means an approved tool list, a written AI usage policy, data classification mapped to AI surfaces, repo hygiene like instruction files and CODEOWNERS, and instrumentation for cycle time, review latency, change failure rate, escaped defects, deploy frequency, and mutation score. The only cost incurred is premium seats. Not before Phase 2, and only on the safe work class - never on auth, money math, or adapters, which stay human-reviewed regardless of phase. Phase 2's unattended agents also depend on Phase 0's instrumentation and Phase 1's pre-review rules already running, so the guardrails exist before the autonomy does. ## Know Which Phase You're In Check your level against the maturity model, or start from the beginning of the framework. [Maturity Model](https://aidlc.guru/maturity-model/) [Learn AIDLC](https://aidlc.guru/learn/)