Agentic coding boosts output, but verification still sets the limit

At a glance

What this is: This is an analysis of how agentic coding workflows can accelerate software delivery, with the key finding that output gains depend on orchestration, test coverage, and tightly bounded delegation.

Why it matters: It matters to security and identity practitioners because AI agents in engineering pipelines introduce new control questions around approval, privilege, verification, and accountability across both human and non-human identity programmes.

👉 Read Sawmills' analysis of agentic engineering and AI-assisted pull requests

Context

Agentic coding changes the delivery model by allowing software systems to execute tasks, open pull requests, and run tests with far less human typing. The governance gap is not speed itself, but the risk that delegation expands faster than verification, especially when agents touch production-adjacent code and privileged workflows.

This matters to IAM and PAM teams because the same pattern that improves engineering throughput can also blur who or what is authorised to change systems, execute commands, and merge code. The more the workflow depends on non-human actors, the more identity, privilege, and audit controls need to be explicit rather than implied.

Key questions

Q: How should teams govern AI-generated code when they cannot review every change?

A: Teams should shift from source-only assurance to runtime assurance. That means correlating deployments, traces, logs, and outcome metrics so behaviour can be validated after code is generated and released. The practical goal is not perfect review coverage, but a dependable record of what the system actually did in production.

Q: Why do agentic coding workflows need stronger verification than normal developer tooling?

A: Because the agent can complete a task exactly as described and still produce incorrect or unsafe output if the instruction was incomplete. Verification has to prove behaviour, not just intent, so tests, linting, and review become the real control layer. Without that, productivity gains simply move risk faster.

Q: What do security teams get wrong about AI agents in CI/CD pipelines?

A: Teams often assume an agent is just another automation step, when in practice it can interpret untrusted text and take actions with real permissions. That means prompt injection, workflow poisoning, and tool misuse become identity and authorisation problems. The control point is not only model safety, but what the agent is allowed to do once it has context.

Q: When should organisations keep coding tasks human instead of delegating them to agents?

A: Keep tasks human when failure is expensive and verification is hard, especially for security architecture, incident response, or novel changes that affect multiple systems. Delegation works best for bounded, testable work where the output can be checked automatically and the blast radius is limited.

Technical breakdown

Agentic coding workflows and delegated execution

Agentic coding tools move beyond autocomplete by taking discrete actions such as running shells, editing files, and creating pull requests. That makes them closer to runtime actors than passive assistants. The architectural shift is from human keystrokes to delegated execution with a defined prompt, a tool boundary, and a review loop. In security terms, the important question is not whether the model can write code, but whether the surrounding control plane can constrain what it is allowed to touch, modify, and deploy.

Practical implication: treat AI coding agents as privileged workflow participants and define their execution boundaries before allowing them into production-adjacent repos.

Verification as the primary control for AI-generated changes

The article’s central operational lesson is that confidence is not correctness. Agentic systems can complete exactly what was asked and still produce unsafe or broken output if the task is underspecified. Tests become the enforceable specification, which means validation shifts from manual judgment alone to a control loop that checks behaviour, not just intent. This is analogous to governance in identity systems: permission to act is not the same as proof of safe action.

Practical implication: require automated tests, linting, and diff review as non-optional gates before any agent-generated change reaches merge or deployment.

Context curation and least-privilege task design

The post shows that successful delegation depends on narrow context, decomposed tasks, and clear success criteria. That is structurally similar to least privilege: the agent performs better when it receives only the files, logs, and scope it needs. Overloading the context window creates uncertainty, while oversized tasks encourage hallucinated assumptions and unsafe shortcuts. The governance pattern here is controlled exposure, not broad access.

Practical implication: break agent work into small, verifiable steps and supply only the minimum context needed for each step.

NHI Mgmt Group analysis

Agentic engineering creates a new governance boundary between assistance and delegated execution. Once a system can run shells, change files, and open PRs, it is no longer just a productivity aid. The control question becomes who authorised the action, under what constraints, and with what evidence of correctness. That is a human identity and NHI governance issue at the same time, because the agent behaves like a non-human actor inside a privileged delivery workflow.

Verification, not speed, is the real security control in agentic coding. The article is explicit that fast agents can be confidently wrong, which means delivery organisations need stronger proofs of correctness than they needed for manual typing. Tests, linting, and review are the governance layer that keeps automation bounded. Without them, the organisation is outsourcing risk rather than work.

Context minimisation is a named control pattern, not just an efficiency trick. Agentic systems perform better when prompts, files, and logs are tightly scoped. That reduces accidental overreach and limits the damage from bad assumptions, making the workflow more resilient. For practitioners, the lesson is to design task slices and access slices together.

Agentic productivity will widen the gap between teams with mature controls and teams that rely on trust. The post shows that orchestration scales, but only when decomposition, review, and rollback are deliberate. In practice, teams that already operate with disciplined change control will absorb agentic workflows more safely than teams that treat them as magic. The strategic conclusion is to govern the workflow first and the tool second.

What this signals

Agentic coding pushes identity governance into development workflows that many IAM programmes have not historically owned. The emerging control issue is not only access to tools, but whether non-human actors are operating under clear authority, bounded scope, and auditable change paths.

Delegation boundary drift: when AI agents move from drafting to execution, the trust model changes faster than most control frameworks. Practitioners should align developer workflow governance with identity and privilege governance so that automation does not outgrow accountability.

For security teams, the practical signal is that agentic engineering will favour organisations that already understand least privilege, change control, and verification discipline. That makes NHI-style governance thinking increasingly relevant outside classic IAM and PAM use cases.

For practitioners

• Define execution boundaries for coding agents Limit which repositories, commands, and environments an agent may touch. Separate read-only analysis from write-capable workflows, and require explicit approval for anything that can modify production-adjacent assets.
• Make tests the merge gate for agent output Require automated tests and linting to pass before any agent-generated pull request can be merged. If the change cannot be verified automatically, keep it out of delegated execution.
• Break work into small, auditable tasks Use narrow prompts, single-purpose diffs, and staged review points so each step can be checked independently. This reduces context sprawl and makes failure easier to isolate.
• Separate planning from execution privileges Use a read-only planning agent for analysis and a distinct execution agent for file changes or shell actions. That separation makes it easier to audit who or what performed each step.

Key takeaways

• Agentic coding increases throughput, but only when execution is tightly bounded and reviewed.
• The real control is verification, because fast agents can still produce unsafe or broken changes.
• Teams that treat AI agents as privileged workflow participants will govern them more safely than teams that treat them as shortcuts.

Key terms

• Agentic coding assistant: An AI-assisted development tool that can decompose tasks, choose actions, and execute parts of a workflow inside the editor. In security terms, it behaves like a non-human identity when it can access code, tools, and terminals on behalf of a developer, so governance must cover its runtime behaviour.
• Context Curation: The practice of deliberately limiting the information an AI system receives so it can complete a task without being overwhelmed by irrelevant data. In security and engineering workflows, it is a control pattern that reduces error, limits scope creep, and improves auditability.
• Approval Gate: An approval gate is the human or policy checkpoint that must be crossed before an AI system can take a state-changing action. For identity governance, the gate is the point where responsibility stays with the organisation, and it should be enforced separately from the system’s ability to observe or recommend.
• Delegated Execution: Delegated execution is when software is allowed to perform actions on behalf of a user, process, or business function. In NHI governance, the risk is that the delegated actor may chain actions beyond the original intent, so controls must focus on scope, approval, and revocation.

What's in the full article

Sawmills' full article covers the operational detail this post intentionally leaves for the source:

• The exact orchestration workflow used to route planning, execution, and review across multiple model types
• The day-by-day account of how the 28 PR afternoon worked across 13 services and what broke during early experimentation
• The specific division between fast and reasoning models for simple versus complex changes
• The practical examples of test-first task design, decomposition, and when the CTO chose not to delegate

👉 The full Sawmills article covers the orchestration workflow, review habits, and team operating model in more detail.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is a strong fit for practitioners who need to govern non-human actors as part of modern delivery workflows.