Topic starter
20/08/2026 6:07 pm
TL;DR: Coding agents are already shaping 16 to 23 percent of code contributions, and Arize argues the real bottleneck is not model capability but the harness, telemetry, and evaluation loops that let agents verify changes against runtime evidence. The governance challenge now is to treat traces as the source of truth for agentic software, because blind automation only scales review overhead.
Editorial analysis by NHI Mgmt Group, based on content published by Arize: “Closing the Loop: Coding Agents, Telemetry, and the Path to Self-Improving Software”.
Key questions
Q: What breaks when coding agents cannot see their own runtime traces?
A: The self-verification loop breaks.
Q: Why do coding agents create a new access-governance problem for software teams?
A: Because they operate as delegated machine actors that can use tools, files, and environments under borrowed authority.
Q: How can security teams tell whether agentic software is actually improving quality?
A: Look for evidence in traces and evaluations, not just successful test runs.
Practitioner guidance
- Instrument agent workflows with runtime traces Capture tool calls, retries, prompts, and environment outputs so every material code change has an evidence trail that an agent can query and a human can audit.
- Constrain delegated permissions by task scope Limit repository, filesystem, and build access to the minimum required for the current task, then revoke or narrow those rights when the task boundary ends.
- Require evidence-based verification before merge Block merge completion unless the agent can show trace-backed validation, test outcomes, and a clear link between the requested change and the observed runtime effect.
Bottom line: Coding agents are moving software production toward runtime evidence, and that makes telemetry part of the control environment rather than a side-channel for debugging.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:41 pm
Telemetry is becoming a governance control, not just an engineering metric. In agentic development, the system that verifies the change is as important as the change itself. If traces, evaluations, and tool-call history are missing or inaccessible, the organisation has no defensible basis for trusting the agent’s output. The practitioner takeaway is to treat observability as part of access governance for coding agents.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between an agent harness and the model behind it?
A: The model generates decisions, but the harness governs how those decisions reach tools and execution environments. That distinction matters because identity, policy, and isolation belong in the harness layer. Without that separation, security teams end up trying to govern runtime behaviour inside the model, which is the wrong layer.
👉 Read our full editorial: Coding agents need telemetry to support self-verifying software loops