An agentic SDLC is a software development lifecycle in which AI agents complete whole units of work under enforced boundaries, and it does not retire agile. It retires agile’s artifacts. Every ceremony you run still has a reason to exist. What each one produces has to stop being a document a human interprets and start being something a machine can read and a control can enforce. Ten habits break in that transition. Below is what I unlearn, what I do instead, and where each one lands on my Five-Stage Agentic AI Roadmap.
The ceremony survives, the artifact does not
The most common mistake I see is treating this as a tooling decision. Buy the agent, keep the process. DORA’s 2025 research on AI-assisted software development landed on the opposite conclusion, describing AI as an amplifier that magnifies the strengths of high performers and the dysfunction of everyone else. Vague requirements do not get better when an agent reads them. They produce vague output faster.
So the question is not which ceremonies to cancel. It is which artifact each ceremony has to start producing, and who can prove it was enforced. That reframing is what separates an AI-native SDLC from a team that bought Copilot licences. It is a governance question, and the answer is an architecture that carries its own enforcement.
The ticket, the estimate, and the sprint
The first habit to unlearn is the user story as the unit of work. “As a user, I want” was written to be interpreted by a human sitting in the same room. An agent has no room. Spec-driven development went mainstream through 2026 for exactly this reason, and the phrase that keeps surfacing in GitHub and AWS material is that the spec is the prompt. What I do now: refinement ends with a committed file in the repo carrying acceptance criteria and an explicit out-of-scope section, not a Jira description. The intent.md convention is where I start.
Second, story points. Points encoded human effort, human uncertainty, human fatigue. For an agent, effort is roughly zero and elapsed time is milliseconds, so the number measures nothing. AWS’s guidance reframes the ceremony as intent design, with goals, guardrails and success criteria fixed before agents execute. I size two things instead: how much verification the change needs, and how much it can reach if it goes wrong. A five-point task is still five points when a human has to check it line by line.
Third, the two-week sprint as the feedback loop. It is not dead, but it is doing the wrong job. One scrum master’s line in early 2026 has stuck with me: she felt like a historian documenting what already happened rather than a manager planning what would. Keep the sprint as the governance and prioritization cadence. Let the build-verify-merge loop inside it run in hours.
Identity, review, and the standup
Fourth, and this is the one that will fail an audit first: agents running under a shared service account or a developer’s personal token. Machine identities now outnumber humans by roughly 82 to one in the average enterprise, and Palo Alto’s 2026 survey found that only 37 percent of organizations can revoke an AI agent’s credentials at all. GitGuardian counted 28.65 million hardcoded secrets pushed to public GitHub in 2025, with AI-service secrets up 81 percent. In my work in regulated loan origination, every agent gets its own named identity, scoped, owned by a person, and inside joiner-mover-leaver. Attribution is the precondition for everything else on this list, not a later hardening step.
Fifth, human code review as the last line of defence. Two things break it. The queue, first: Faros AI’s telemetry across 1,255 teams found high-adoption teams merged 98 percent more pull requests while review time rose 91 percent and average pull request size grew 154 percent. Then the fix everyone reaches for, which is circular. Point an AI reviewer at AI-written code with no external specification and, as one 2026 paper argues, both agents reason from the same artifact and share the same training distribution, so their errors echo instead of cancelling. I tier it: deterministic checks first, the spec as the external reference second, human judgment reserved for architecture, security, and anything irreversible.
Sixth, the standup as a round-the-room status report. Status is already in the logs. The version I run is exception triage: what escalated, what a hook blocked, what an agent retried three times, what is queued for a human. The tech lead reads the agent run logs beforehand and reports on their behalf. Agents do not get a speaking slot.
More on the Agentic SDLC
- The Six Layers: My definition of agentic AI architecture, and why enforcement is the layer teams skip.
- Intent as the Unit: What actually changes when intent becomes the unit of work, and why the artifact chain matters more than the tooling.
- The Committed Ask: Why I treat intent.md as a regulated record from day one rather than a developer convenience.
- Sequencing the Plays: Anthropic’s playbook sorted so that each play arrives only after the control it depends on exists.
- Know Before You Build: Ten facts I wish every architect knew before writing a line of agent code.
Done, tested, and measured
Seventh, the Definition of Done that reads “merged and the pipeline is green.” That was a reasonable proxy when a person wrote every line. Now done means the evidence exists: the trace, the eval scores above threshold, the gate log, and the named identity that made the change. In a regulated shop that bundle is the deliverable. The code is a by-product of it.
Eighth, deterministic test suites as the quality gate. A unit test asserts equality on a fixed path. An agent takes a different path on every run, and several different outputs can all be correct. So the practice shifts to eval-driven development: score against a labelled dataset, gate the build on thresholds rather than assertions, and promote every production failure into the regression set. Ordinary tests do not go away. They cover the deterministic scaffolding around the agent, which is still most of the system.
Ninth, velocity. This is the habit with the hardest evidence against it, and it is also the one executives cling to. In the Faros data above, teams completed 21 percent more tasks and shipped far more pull requests while organizational DORA metrics did not move at all. Self-reporting is worse than useless here. METR’s randomized trial found experienced developers were 19 percent slower with AI tools while estimating they had been 20 percent faster, a perception gap of nearly 40 points from people who had just lived through the tasks. I track cost per completed task and change failure rate. Points per sprint tells you what the agents produced, not what survived.
The retro that changes something
Tenth, the retrospective that ends in action items on a wiki page. The agent never reads that page. Mitchell Hashimoto’s framing is the right one: engineer the harness so the agent never repeats the mistake. Every retro finding has to land as a hook, a rule file, a checklist step, or a new eval case. If it is not in the harness, it did not happen. That is my test for whether a team has reached Assured or is still telling itself stories at Governed.
The ten, side by side
| Unlearn | Learn instead | Roadmap stage |
|---|---|---|
| The user story as handoff | A committed spec or intent.md | Prompted |
| Story points as effort | Verification cost and reach if wrong | Piloted |
| The sprint as feedback loop | Layered cadence, hours inside weeks | Piloted |
| Shared service accounts | One named identity per agent | Governed |
| Uniform human code review | Tiered review, humans on the residual | Governed |
| Standup as status report | Exception triage over run logs | Governed |
| Done means merged and green | Done means the evidence bundle exists | Assured |
| Deterministic tests as the gate | Eval suites scored against thresholds | Assured |
| Velocity and points per sprint | Cost per completed task, change failure rate | Assured |
| Retro action items in a wiki | Retro findings written into the harness | Autonomous |
What this is really about
None of these ten are about the model. They are all about where the rigor sits. Agile put it in conversation, in shared understanding built up in a room over two weeks. That worked because humans were the only things producing code, and humans could be talked to. When the thing producing the code cannot be talked to, the rigor has to move into artifacts that carry their own enforcement: the spec, the hook, the identity, the eval, the gate log.
Instructions in, results out was IT. Intent in, outcomes out is agentic AI. The uncomfortable part is that the ceremonies mostly survive intact, so it is easy to believe nothing has changed. I keep coming back to the same tell. Can your retro change what an agent does next week without a person remembering to enforce it? If not, the team is running agile theatre over an agentic delivery model, and the gap will show up in the audit before it shows up in the metrics.
Which of the ten is your team still doing out of habit?
Go deeper
- Agentic AI Architect: control design for enterprise agents.
- Agentic AI Case Studies: deployment evidence, one teardown at a time.
- Agentic AI P&L: cost, payback, and risk in a CFO’s voice.
- Agentic AI Governance: who owns the harness.
- Substack first access: agenticaiarch.substack.com/subscribe
- Intent In, Outcomes Out
- Earned Autonomy.
© Dr. Harish Kotadia, Ph.D., All Rights Reserved, 2026.
Dr. Harish Kotadia, Ph.D., is an Enterprise AI Architect with 20+ years of IT consulting experience serving Fortune 100 clients, specializing in agentic AI systems for regulated enterprise environments, including multi-agent systems in regulated loan origination.
Disclaimer: This blog post is based on publicly available academic publications, vendor documentation, open standards, and news items from reputed media sources linked above. This post is intended for educational purposes, to help the enterprise agentic AI community build a shared vocabulary from public, authoritative sources.
Views and opinions expressed here are my own and do not represent those of any employer or client, past or present. The analysis presented is my independent interpretation of the published sources linked above and does not constitute legal, financial, or consulting advice of any kind.