Keep the thread from requirement to AI-assisted release.

Imagine a coding agent implementing a change to account access. The ticket says “improve tenant isolation,” the pull request is persuasive, and the tests pass. None of those facts establishes that a user in one company cannot read a resource in another. The requirement needs a specific actor, resource, boundary, and expected refusal before implementation begins.

Write a small acceptance record: an authorized user may read the selected company’s resource; an unauthorized user receives no resource details; a stale membership no longer grants access. Assign each condition an identifier. Include failure behavior and an owner who can resolve ambiguity. This is a practical starting point for an AI-assisted software development life cycle, or AI-SDLC.

Provide the accepted requirement version, relevant architecture constraints, permitted files or services, and a test command that exercises the behavior. Separate repository instructions from untrusted issue text or external documents. Grant tools the minimum permissions needed for the task. A coding agent that can edit application code does not automatically need production credentials or release authority.

Retain the resulting diff and its relation to the requirement. Record important design choices when they affect the acceptance boundary, such as evaluating the current membership at read time instead of trusting an old client-side role. Avoid archiving every conversational turn by default: keep enough context to explain the decision while respecting data minimization and retention rules.

A test that merely repeats the implementation is weak evidence. First demonstrate the failure with the old behavior when practical. Then show that the same check passes with the change. For the tenant example, test an authorized read, a foreign identifier, and membership revocation. Assert the absence of restricted details as well as the status code.

Keep test identity, execution time, source revision, environment, and outcome connected. Label fixtures honestly. A mocked provider test can establish how the application handles a timeout; it cannot establish that a live provider is reachable. NIST’s Secure Software Development Framework offers high-level practices that can be integrated into a development life cycle. This requirement-to-test record is a suggested way to make selected practices inspectable.

A green branch is not an artifact identity. Capture the built output’s digest, source commit, build configuration, and relevant dependencies. Match the deployment to that output. If a later commit changes the behavior, previous checks do not automatically cover it. Keep the release decision attached to the tested revision and record which checks remain intentionally outside the scope.

SLSA provenance describes how an artifact was produced, including the build definition and run details. It supplies an established structure for build provenance; it does not prove application correctness or authorize a release. Use it alongside behavioral tests, access checks, and the organization’s release decision. Retain rollback instructions tied to a known artifact rather than a vague instruction to redeploy the previous version.

Before expanding coding-agent adoption, select one recent change and walk backward from its deployed artifact. Identify the release decision, exact checks, implementation diff, acceptance conditions, and business owner. Any missing connection is a delivery-system improvement task. The objective is a usable chain that survives team turnover and investigation, not another dashboard of activity counts.

Track review rework, escaped defects, and time to recover a decision’s basis alongside delivery speed. Compare like-for-like changes before attributing improvement to AI. LockedIn Labs describes AI transformation and product engineering as connected work; this traceability pattern turns that connection into a concrete team practice. ControlFrame’s evidence documentation is relevant to preserving assurance records, while software delivery retains its own engineering and release ownership.