Topic starter
20/08/2026 5:27 pm
TL;DR: Agent centric development replaces micro-commit CI with a Guide, Verify, Solve loop where AI coding agents work longer in sandboxes and self-correct before review, making deterministic verification and structured context mandatory for trustworthy code, according to Sonar. That shift turns developers into supervisors of agent output, while exposing a new governance problem: quality, security, and architecture controls must now govern large asynchronous payloads rather than human-written incremental changes.
Editorial analysis by NHI Mgmt Group, based on content published by Sonar: “The future is AC/DC: the Agent Centric Development Cycle”.
Key questions
Q: How should security teams govern AI agents that have their own sandboxes?
A: Security teams should govern AI agents with the same discipline used for other machine identities, but extend the model to include the sandbox, the agent account, and every delegated integration it can reach.
Q: Why do large agent-generated code drops create more risk than small commits?
A: Large agent-generated drops compress many decisions into a single review event, so early mistakes, hidden dependencies and insecure logic are harder to detect.
Q: What do teams get wrong about self-verifying AI coding systems?
A: The common mistake is assuming a model that can reflect on its work can also certify it.
Practitioner guidance
- Define agent verification thresholds Set explicit quality profiles for AI-generated code and require deterministic checks for each profile before code can leave the sandbox.
- Constrain agent tool and repository access Limit the repository, verification and repair permissions that agents can reach, especially where MCP-connected tools expose issue data or quality gates.
- Treat sandbox review as the primary gate Move dynamic testing, reliability checks and security analysis into the agentic sandbox so large payloads are validated before merge.
Bottom line: Agent centric development shifts the main governance problem from reviewing small human commits to controlling large agent-generated changes before they enter the main codebase.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:16 pm
Agent centric development turns software governance into identity governance. Once code generation is delegated to AI systems, the real control question becomes who or what can access the repository, the verification context and the remediation path. That shifts the centre of gravity from developer productivity to governed non-human access, which is exactly where identity teams already know how control failures accumulate. Practitioners should treat agent permissions as a first-class governance object.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between agent supervision and code review?
A: Agent supervision governs the inputs, permissions and checkpoints that shape what the AI system can do while it is still working. Code review inspects the resulting output. In agentic development, supervision matters more because by the time a huge payload reaches review, many of the risky decisions have already been made inside the loop.
👉 Read our full editorial: Agent centric development is rewriting software governance