Notifications
Clear all
Topic starter
18/08/2026 2:45 pm
TL;DR: AI coding agents can read, plan, test, and ship code in one session, compressing SDLC cycles faster than human review can follow, according to Fiddler. The real governance issue is not whether agents belong in the lifecycle, but whether teams can observe and control the sensitive data and tool calls that move through it.
NHIMG editorial — based on content published by Fiddler: What Is the Software Development Lifecycle (SDLC)?
By the numbers:
- By 2025, 84% of developers surveyed reported using or planning to use AI coding tools.
Questions worth separating out
Q: How should security teams implement AI code generation controls in the SDLC?
A: Start at the point of generation, not at the point of release.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: What breaks when security is only checked at the end of the SDLC?
A: Late-stage security cannot prevent leaks that already happened during development, testing, or agent execution.
Practitioner guidance
- Instrument agent sessions end to end Capture session IDs, tool calls, file touches, and pull request context so teams can reconstruct what the agent did before code is merged.
- Enforce inline data controls at the gateway Apply redaction or blocking before prompts, responses, and tool outputs can enter logs, traces, or commits.
- Treat agent-connected tools as privileged access paths Review MCP servers, model gateways, repositories, and test environments as access-bearing integrations with explicit ownership, entitlement review, and offboarding.
What's in the full article
Fiddler's full blog post covers the operational detail this post intentionally leaves for the source:
- Examples of inline policy decisions across LLM and MCP gateway traffic that distinguish allow, redact, and block outcomes
- Implementation details for joining agent-side telemetry with gateway-side events using shared session identifiers
- Specific handling patterns for PII, PHI, and secrets when a coding agent must continue working after redaction
- The platform-side explanation of how request-path enforcement differs from downstream monitoring and audit logs
👉 Read Fiddler's analysis of how AI coding agents are changing the SDLC →
AI coding agents and the SDLC oversight gap for security teams?
Explore further
18/08/2026 3:28 pm
AI coding agents have turned SDLC governance into an identity problem. When a non-human system can plan work, call tools, and produce commits in one session, the old assumption that people are the only meaningful actors inside delivery no longer holds. That matters because approval, traceability, and accountability all depend on knowing who or what acted. Practitioners should treat agent sessions as governed identities inside the software factory.
A question worth separating out:
Q: Should organisations treat MCP-connected coding tools as privileged access?
A: Yes, because these tools can mediate access to repositories, databases, and other enterprise systems on behalf of an agent. That makes them access paths, not just developer conveniences. Organisations should review entitlements, enforce least privilege, and offboard unused tool connections with the same discipline used for other privileged integrations.
👉 Read our full editorial: AI coding agents are compressing the SDLC oversight gap
