Topic starter
01/08/2026 8:53 pm
TL;DR: Watching engineers use AI coding agents on real work showed that cheap models often shift cost from tokens to human correction time, shadow usage, and slower delivery, according to StackHawk. The governance lesson is that model choice now behaves like a control decision, not a personal preference, because the real risk sits in workflow economics and ungoverned tool use.
Editorial analysis by NHI Mgmt Group, based on content published by StackHawk: “What We Learned Watching Engineers Use AI Agents for Real Work”.
Key questions
Q: How should organisations govern model selection for AI agents?
A: Organisations should treat model selection as a governance decision, not a local implementation detail.
Q: Why do cheaper AI models sometimes cost more in production?
A: Because total cost includes retries, failed completions, cache resets, and operator time.
Q: What are the warning signs that GenAI governance is failing in production?
A: Common signs include rising token spend without clear business growth, poor traceability of prompt flows, inconsistent routing between models, and backend services that still contain long-lived API keys.
Practitioner guidance
- Define model-tier approval rules Set policy for which engineering tasks may use token-free, workhorse, or frontier models, and require stronger models for sensitive or high-consequence changes.
- Track correction-time signals Measure reprompting, manual fixes, and repeated clarification cycles so model choice is evaluated against engineer time, not only token spend.
- Eliminate personal-account workarounds Provide sanctioned access to approved model tiers so engineers do not route around governance with personal keys or unmanaged accounts.
Bottom line: AI coding agent model choice is now a governance issue because cheaper models can push cost into human correction time and unmanaged workarounds.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:02 pm
Model choice has become a governance control, not a developer preference. The article shows that the real decision is whether an organisation accepts a token-saving choice that quietly increases human remediation time. Once AI coding agents are embedded in delivery work, the cost centre shifts from software spend to workflow governability. Practitioners should treat model tiering as policy, not habit.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should teams use the same model tier for every coding task?
A: No. Routine autocomplete, multi-file changes, and security-sensitive decisions have different risk profiles and should not all map to the same tier. A single default makes governance easy but ignores where correctness matters most. The better approach is to define when a stronger model is justified and when a cheaper one is sufficient.
👉 Read our full editorial: AI coding agent model choice is an IAM and governance decision