Software Engineering Practices in the AI Era

Document Institutional Knowledge: Documentation is how a newcomer gets up to speed. Now the newcomer is also a machine. Agentic onboarding fails when institutional knowledge goes undocumented. Teams with strong onboarding docs adopt AI faster. For brownfield apps, use agents to generate documentation from code and validate it. Use techniques such as knowledge graphs or RAG where they help.

Enable Agentic Access: Often, documentation lives in different places: product vision in Microsoft 365 slides, PRDs and designs in Confluence, JIRA, READMEs, tech-debt tickets and ADRs in GitHub, bug reports and incident postmortems somewhere else. Give agents structured access to these sources (for example, via MCP). Alternatively, consolidate the docs so a coding agent can navigate across them.

Leverage Agents for All Abstractions and Limit Drift: Use agents to draft and maintain artifacts across the software engineering lifecycle: product vision, PRDs, design, architecture, specs, tests, code, and operations. The order of generation is important. Generate higher-level abstractions first (e.g., design and test cases before code). As artifacts grow, they drift out of sync. Agents can keep them aligned. Reinvest time saved on drafting into reviewing, walking edge cases, and securing alignment.

Keep Pull Requests Reviewable: With agentic updates, a human is accountable for every change. Keep pull requests small enough to review, especially at the top-level abstractions (vision, PRDs, design). Add agentic reviewers as a secondary judge.

Generate Tests Before Code: Tests are an executable record of what the system should do. The agentic loop is built for grinding on an implementation until the tests go green. Use agents to increase the breadth and depth of coverage (covering edge cases, error paths, property-based tests, and fuzzing) and to generate post-deployment validation that confirms the intended behavior in production and higher environments.

Security: The state space of security analysis can be large. Use agents alongside human review to run threat models that detect and document vulnerabilities at each abstraction layer. These threat models cover:

• Static analysis in CI. SAST, SCA, linting.
• Principle of least privilege. At every boundary, component, and service.
• Security-focused review on sensitive surfaces. Auth, crypto, and data-handling.

Performance & Reliability: Use agents to build automation that runs performance benchmarks by simulating real traffic and generating system metrics. Use agents to integrate with observability tools for identifying underlying system limits. Measure platform reliability and availability under load.

Operationalizing: Use agents to build automation for CI/CD, staged promotion, progressive rollout, and observability infrastructure. Capture these as code artifacts that are version-controlled: CI/CD Pipeline Templates, IaC, Code Configs, Observability as Code, Dashboards as Code. Agents should never connect directly to production. Instead, build automation with managed access control so agents can interact with production through automation and APIs: deploying, rolling out, and reading observability data (metrics, traces, logs). Agents can then correlate code PRs with deployments and observability data to explain cause and effect, and file bug reports for defects.

Measuring the System: Use agents to build automation for tracking and measuring to streamline engineering processes. The DORA metrics are a good starting point.

• Deploy frequency — many small deployments or few large ones?
• Lead time for changes — how long does a commit take to be deployed?
• Change failure rate — stable, or creeping up as you ship faster?
• Time to restore service — how quickly can one restore impacted services?