Cleaner code lowers AI agent costs without improving task success

At a glance

What this is: Sonar's study found that cleaner code made AI agents cheaper to run and less likely to revisit files, but it did not materially improve whether tasks were completed.

Why it matters: For IAM and AI governance teams, the result matters because agent cost, control flow, and code readability are now part of how autonomous and semi-autonomous systems should be managed.

By the numbers:

• The study covered 540 coding runs across six matched repository pairs.

Context

Cleaner code is no longer only a developer ergonomics issue. In agentic workflows, code structure affects how much context an AI system must read, re-read, and reason through before it edits anything, so maintainability becomes a runtime governance issue as well as a software quality issue.

That matters for identity and access programmes wherever AI agents can touch code, pipelines, or operational tooling. If an agent has to inspect more files, revisit more state, and spend more turns to complete the same work, cost, oversight burden, and error exposure all rise together.

Key questions

Q: Why does messy code increase the cost of AI-assisted development?

A: Messy code forces agents to read more, revisit earlier edits, and spend extra turns rebuilding context before they can safely change anything. That increases token consumption and review overhead even when the task still completes. The underlying problem is not model weakness alone. It is the friction created by low-legibility code structures.

Q: How should teams measure whether AI coding agents are efficient?

A: Use a mix of outcome and effort metrics. Completion rate tells you whether the agent finished the task, but input tokens, output tokens, file revisits, and time to first edit show how much machine effort the task consumed. If effort stays high while success stays flat, the codebase is creating avoidable friction.

Q: What signs show that a codebase is difficult for AI agents to work in?

A: Look for repeated file revisits, long delays before the first edit, and high token usage on otherwise similar tasks. Those signals usually mean the agent is struggling to stabilise context because the code is too nested, too inconsistently named, or too hard to navigate quickly.

Q: Should security teams treat agent permissions differently in messy repositories?

A: Yes, because broader permissions in a hard-to-navigate codebase can amplify both cost and risk. If an agent must inspect or modify large parts of the repository to complete small tasks, keep its access narrowly scoped and pair that with stronger change review and traceability. Complexity should reduce, not expand, the agent's operating envelope.

Technical breakdown

Why code structure changes agentic inference cost

AI agents do not struggle because they are confused in a human sense, but because every extra branch, nested block, and ambiguous name expands the context they need to inspect before acting. In a multi-step workflow, the agent spends tokens on reading, revisiting, and confirming state, not just on generating output. Cleaner structure reduces that search space. Smaller functions, clearer naming, and more direct control flow shorten the path from task description to edit, which is why cost can fall even when completion rate does not change.

Practical implication: Treat code readability as a cost-control input for agentic workflows, not just a human maintainability preference.

Why file revisits signal higher agent friction

File revisits show how often an agent has to return to material it already touched because it has not yet stabilised its working model of the codebase. That usually means more uncertainty, more re-reading, and more re-checking before the next edit. In cleaner code, the agent reaches a usable mental model faster and moves on with fewer backtracks. That is a behavioural signal, not just a cost signal, because it shows the task is easier to navigate at runtime even when the end result is the same.

Practical implication: Use revisit-heavy agent traces as an operational indicator that your codebase is making AI workflows work harder than they should.

Why task success can stay flat while cost changes

A stable completion rate alongside lower token use means the code quality effect is primarily about efficiency, not capability. The agent can still finish the work, but it needs less exploration to do so. That distinction matters for governance: if you only measure pass rate, you miss the hidden operating expense and the extra opportunity for drift, retries, and wasted tool calls. For programmes scaling AI coding assistants, the relevant question is not only whether the task succeeds, but how much machine effort the success consumes.

Practical implication: Track both task completion and agent effort so you can spot when a system is working correctly but inefficiently.

NHI Mgmt Group analysis

Cleaner code is now part of AI governance, not just software engineering hygiene. Sonar's result shows that code structure changes the operating economics of AI agents, which makes maintainability a control variable for any programme deploying agentic development at scale. The governance question is no longer only whether the codebase is readable to humans, but whether it is legible enough for machine workflows to operate predictably. Practitioners should treat code quality as a runtime dependency for agent oversight.

Agentic inference cost is becoming a new form of technical debt. The cost driver is not only the model, but the amount of context the agent must consume to understand the task, and messy code increases that burden. This creates a compounding effect: the more complex the repository, the more tokens, tool calls, and re-reading the agent needs, which can quietly erode the economics of AI adoption. Teams should expect code quality debt to show up in AI spend before it shows up in delivery metrics.

Named concept: agentic readability tax. This is the extra machine effort created when code structure forces an AI agent to spend more turns building context than executing change. It is the same underlying problem as human code smell, but with a different operating cost profile because the penalty lands in tokens, revisits, and retries. Practitioners should measure and reduce that tax if they want AI-assisted delivery to remain economically viable.

Task completion is a weak success metric for agent governance. The study shows that an agent can complete the same work while consuming materially different resources, so completion alone hides important control failures and efficiency losses. That is especially relevant for organisations governing code-writing agents, where cost overruns, excessive file churn, and repeated context rebuilding can indicate weak repository hygiene even when output appears acceptable. Teams should judge agent programmes on effort as well as outcome.

The identity and access angle is indirect but real when AI agents are given operational reach. Once agents can read repositories, edit code, or interact with delivery tooling, their access patterns become part of the control surface. Cleaner code reduces the amount of material those agents need to inspect, which can lower both exposure and noise in audit trails. Practitioners should align agent permissions and repository hygiene so machine access stays proportionate to task scope.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Security Guide

What this signals

Agentic runtime efficiency is becoming a governance signal. The practical lesson is that teams running coding agents need to watch token use, revisits, and edit latency as programme-level indicators, not just engineering curiosities. When the same task consumes more machine effort in one repository than another, that difference usually reflects a repository hygiene problem rather than an AI capability problem.

Agentic readability tax: this is the extra cost imposed when code structure makes an AI agent spend more time reconstructing context than making changes. Cleaner repositories reduce that tax, but the bigger governance point is that access scope and repository complexity must be managed together so agent permissions do not outgrow the environment they operate in.

The evidence is consistent with a broader shift in agent governance: 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey. That makes workload scope, repository legibility, and access discipline part of the same control conversation.

For practitioners

• Measure agent effort alongside completion rate Track input tokens, output tokens, file revisits, and turns to first edit for each recurring coding workflow. Completion alone hides the hidden operating cost of messy code and makes it harder to see which repositories are expensive for agents to work in.
• Prioritise repository clean-up in agent-heavy codebases Focus refactoring on deeply nested logic, inconsistent naming, and large functions in repositories where AI assistants already do meaningful work. Those are the conditions most likely to drive extra re-reading and repeated context reconstruction.
• Set governance thresholds for agentic runtime efficiency Create internal thresholds for acceptable token spend, revisit rates, and edit latency on standard tasks so engineering leaders can distinguish normal variance from structural inefficiency.
• Review AI agent access against repository complexity Where agents can modify code or interact with delivery pipelines, align their permissions with the minimum task scope and the complexity of the repositories they touch.

Key takeaways

• Cleaner code reduces the operational cost of AI agents even when it does not change whether the task is completed.
• File revisits, token usage, and time to first edit are more useful governance signals than success rate alone for agentic development.
• Repository hygiene and access discipline now influence how efficiently AI agents can operate, which makes code quality a control issue as well as a software quality issue.

Key terms

• Agentic Inference: Agentic inference is the multi-step work an AI agent performs while it reads files, calls tools, revisits context, and produces changes. In practice, it includes far more than prompt-and-response generation, which is why code structure can materially change cost and behaviour.
• File Revisit Rate: A measure of how often an AI agent returns to files it has already inspected or edited during the same task. High revisit rates usually indicate weak context stability, unclear code structure, or repeated validation loops, all of which increase runtime cost and make automation harder to govern.
• Repository Legibility: How easily a human or machine can understand the structure, naming, and control flow of a codebase without excessive re-reading. Legibility is not just a developer experience property. For AI agents, it determines how much context must be consumed before a safe and accurate change can be made.
• Agentic Readability Tax: The extra computational and operational burden imposed when code structure forces an AI agent to spend more turns reconstructing context than making the intended change. It is a practical way to describe how poor code hygiene becomes a measurable cost driver in agent-enabled software delivery.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.