Agentic AI maturity in the SDLC: from copilots to autonomous coding agents

Agentic AI maturity in the SDLC is the number of the six lifecycle phases an agent runs end to end, together with the controls that decide its actions in each phase. A copilot works inside one phase, and a person drives it. An autonomous coding agent crosses phases, opens pull requests and waits for gates. The distance between the two is not model quality but the evidence and policy that let a merge happen unread.

Most engineering orgs are further along on the first half than the second: agents are in the editor, and the controls are usually a settings file per vendor and an unenforced policy document.

The quick win: three rules in monitor mode, this week

Before changing any rollout, write three rules and run them observing only.

1. After reading a secret, deny network egress. Once a session has touched .env, ~/.aws/credentials or an SSH key, block outbound calls for the rest of the session. This is the rule that closes the read-then-send pattern, and it is cheap because it needs a few flags per session rather than inspection of every payload.
2. No merge without a passing required check. Enforce it server side with a ruleset or protected branch, not in a prompt and not in a git hook that --no-verify skips.
3. No production deploy without a named approver. Approve the release rather than the tool call.

Run all three in monitor mode for a week and count what they stopped. Alyria's SDLC track then scores all six phases, and the two control questions tell you whether those rules are enforced anywhere outside the model.

The three rungs, in SDLC terms

Rung 1: the copilot. A person edits, the AI suggests, the person accepts. Automation is level 1 in a single phase, usually implement, and the rest of the lifecycle is untouched. This is the rung almost everyone is on: in the Stack Overflow 2026 survey, 66 percent of AI users name coding assistants and agents as their top use case, ahead of chatbots at 63 percent, and 73 percent use them daily.

Rung 2: the bounded agent. An agent runs one phase end to end when a person triggers it. It triages every new issue, or writes the first test, or proposes the dependency bump. Automation is level 2 in one phase and level 1 elsewhere. The interesting control questions start here, because the agent now reads things a person did not choose.

Rung 3: the autonomous coding agent. An event triggers a run that crosses phases: analyse the issue, change the code, run tests, open a pull request, respond to review. Automation is level 2 across several phases, and a person is involved at the gates rather than inside the work. This rung needs every control in the table below, and it is where the difference between a demo and a program shows.

The six phases, and what level 2 requires in each

Phase	What a bounded agent does	What an autonomous agent does	Control that has to exist
Plan	Drafts the issue, proposes scope	Triages, de-duplicates and routes every new issue	Issue state an agent cannot rewrite without a record
Design	Proposes an approach for review	Writes the design note and links the decisions it relied on	Traceable source for what the agent read
Implement	Suggests edits a person applies	Edits files and runs commands across the repository	Policy on tool calls and on what the session already read
Test	Writes a first test	Runs the suite, updates tests and explains failures	A check that the agent did not weaken the test to pass it
Deploy	Prepares a release note	Triggers the pipeline and opens the pull request	Gates that verify evidence before the next step
Observe	Summarises failures	Triages incidents caused by its own changes	Audit record that ties the change to the decision

Two rows carry most of the risk. Implement is where the agent can reach secrets, and Deploy is where a change becomes customers' problem. A program that is at level 2 in Plan and Test and level 0 in those two is not unusual, and it is a reasonable place to be for a quarter.

Why a person still cannot review every diff

An agent that opens pull requests faster than reviewers can read them turns review into a rubber stamp that produces approvals on the record.

Reliability numbers set the ceiling on automating review. The strongest entries on the Berkeley Function Calling Leaderboard score 77.47 percent overall and 68.38 percent on multi-turn tasks. On the tau2-bench leaderboard, Claude Opus 4.5 solves 79.61 percent of retail tasks once and 51.75 percent of tasks on all four of four attempts. Neither figure is a software-merge failure rate: the first measures tool-call accuracy on a function-calling benchmark, the second how often a retail task is solved on all four attempts. They show only why agent output still needs independent verification.

That argues for gates over review volume. A gate is a decision taken outside the model by something that will not be talked out of it: a required status check, a ruleset, a server-side approval, a policy engine that denies the call. The gate layer is covered in gates for coding agents, the stage map in governing agents across the SDLC, and the evidence in evidence for AI-written code.

Controls that have to hold at every rung

Inventory. Which agents, CLIs, versions and MCP servers are on the machines that write your code. Client config files decide which servers a client trusts, they live on laptops, and they change without a ticket. Among 1,899 open-source MCP servers, 7.2 percent carried general vulnerabilities and 5.5 percent showed MCP-specific tool poisoning (MCP at First Glance, arXiv 2506.13538). Alyria Beacon inventories the AI layer on each endpoint and flags hygiene and exposure, including down-level tools, unpinned servers and secrets in config.

Policy. Written rules that name tools, data classes and destinations, authored once and applied to every vendor. Lyra is capability-brokered and information-flow-aware, which means a rule can follow data across tools rather than judging each call alone. That is what makes "after reading a secret, deny egress" a rule rather than a hope.

Monitor then enforce. Rules start in monitor mode, where decisions are recorded and nothing is blocked. Promoting a rule to enforce is a deliberate admin decision, one category at a time, on evidence from your own traffic. A pipeline enforcement change that arrives without a monitor week is the change most likely to be rolled back.

Audit chain. A signed, hash-chained record of the decision, the rule, the revision and the resulting action, exportable and verifiable. On the SDLC track this is the control question about proving that required steps completed before work moved forward. A git hook that can be skipped with --no-verify does not prove it.

Approvals. Specific, few, and attached to the action that matters: the merge to a protected branch, the production deploy, the destructive command. How to place them without generating fatigue is the subject of human approvals for AI agents.

Where agents bypass the pipeline entirely

CI and repository settings govern what reaches the default branch. They do not govern the laptop. An agent editing files locally, calling a stdio MCP server over a pipe and reading a credentials file never crosses a server-side control, and stdio calls never touch a network gateway.

That asymmetry makes endpoint governance and pipeline governance complements, not alternatives. Alyria Beacon evaluates policy at the endpoint where the call originates, locally and deterministically, and exports the resulting decisions. For teams that want the agent inside a governed boundary rather than on a laptop, Statio hosts it on a Beacon-governed node in your own cloud, with every model and tool call mediated by construction.

Moving from rung 2 to rung 3

The sequence that works, in order:

1. Inventory the fleet and keep the inventory current. Without it the rest is guesswork.
2. Write three to five policy rules with no false positives, and run them in monitor mode for a week.
3. Put the gates in the repository: required checks, required review and a rule that the agent cannot approve its own pull request.
4. Design approvals for merge and deploy only, and record who approved what.
5. Promote enforcement per category, and keep the monitor decision log as the record of why.
6. Move one more phase to level 2, then rescore.

Two shortcuts cost more than they save: skip the inventory and the first incident is the first discovery; skip monitor mode and the first enforcement change is the first outage.

Frequently asked questions

What counts as level 2 in the SDLC track?

An agent runs a phase end to end every time it is triggered, with the phase's gates and policy in place. For example, an agent that triages every new issue the moment it is filed, labelling, de-duplicating and routing it automatically, scores 2 on the Plan questions that cover triage.

Do we need to replace our AI gateway?

No. A gateway governs what is routed through it, which is worth having. It has nothing to see on stdio MCP calls, local shell commands or file reads, so the endpoint layer still needs to exist. The comparison is set out in can an AI gateway control coding agents.

How do we score the control questions honestly?

Ask for the artefact rather than the answer. A policy is a claim until it decides something, a gate until it blocks something, and an audit chain until a second person exports and verifies it. If the artefact takes an afternoon, the honest score is 1.

Where do human approvals belong in an autonomous pipeline?

On the merge to a protected branch and on the production deploy. Both are well-defined actions with an obvious owner, and both are rare relative to tool calls.

How long should a phase stay in monitor mode?

A week of real traffic is enough to read the decisions and spot the false positives. Keep the log: it answers the question of why a rule exists six months later.

Get a full Alyria maturity assessment

Alyria assesses your agents and controls across functions using Compass (compass.alyria.ai), and delivers a scored maturity report and a roadmap. Talk to us about a full assessment, or score your own team first with the free software development track on alyria.ai and read the agentic AI maturity model behind it.