Definitions and the Delivery Model

The vocabulary everything else depends on: agent, loop, turn, work class, oracle, action boundary, absorption capacity.

Assistant

A system producing output a human evaluates and acts upon, with no capability to write to a system of record. The governing control is human judgment at the point of acceptance.

Agent

A system that decomposes a goal into steps, invokes tools, and produces side effects with delegated authority, without per-step human approval. In an SDLC context the side effects are concrete: a commit, a branch, a pull request, a merge, a package publication, a deployment, a ticket transition.

The boundary is crossed silently and often. An assistant that gains a terminal is an agent. Classify by capability, not by product name.

The agentic loop

The unit of agent work: a bounded cycle of context assembly, planning, action, observation, and self-verification, terminating in a proposal, an escalation, or a stop. Section 5 treats it in full. The loop is the correct unit of analysis because it is where cost, failure, and control all actually live—not the prompt, and not the pull request.

Turn

One full cycle of model evaluation, tool invocation, and result processing within a loop. A turn is the natural unit for iteration limits and for telemetry.

Work class

A category of engineering work delegated to agents as a policy decision rather than task by task—build repair, test backfill, dependency remediation, migration campaigns, documentation maintenance. Section 6 provides the taxonomy. Work classes, not individual tasks, are the unit at which delegation should be governed, because a per-task decision does not scale past the point where agents outnumber engineers.

Oracle

The mechanism that determines whether agent output is correct, independent of the agent that produced it. Tests, build success, type checking, mutation kill, differential comparison against a reference. The presence, strength, and immutability of an oracle is the single best predictor of whether a work class can be safely delegated.

Action boundary

The point at which a decision becomes a durable side effect. Four matter, and they are the four gates in Section 19: intake, merge, release, and operational action.

Agent-authored artifact

Any artifact whose content was model-generated, regardless of subsequent human editing. The definition is deliberately broad because apportioning authorship line by line has no well-defined answer. A widely used editor added an automatic co-authorship commit trailer in March 2026 with three settings, and shipped it defaulting to off.¹⁶ That default is instructive: the software best positioned to attribute authorship declines to do so automatically. Classify at the artifact level, where the answer is determinate.

Absorption capacity

The rate at which an organization can review, understand, integrate, operate, and maintain incoming change. The binding constraint in agentic delivery, and rarely measured.

Comprehension debt

The widening gap between how much code exists in a system and how much of it any human genuinely understands.¹⁷ Unlike technical debt it produces no failing test and no friction signal until someone needs to change the code.

Fleet

The population of agents an organization operates, considered as a managed system with its own identity, cost, telemetry, and failure modes. Fleet-level thinking is what distinguishes the Delegated stage from the Assisted stage.

Leverage

The ratio of production capacity to human supervision capacity. It is the quantity every executive wants expressed as a number, and no published data supports one. Section 9.2 addresses this directly.

Non-human identity

Any principal that is not a person. In cloud environments non-human identities already outnumber human users at ratios between 45:1 and 144:1; agents are a new subclass with goal-directed, variable behavior.¹¹⁶

2.1 The Population Problem #

Organizations undercount their AI participation because they count what they procured. The actual population includes assistants and agents licensed centrally; coding agents running locally under individual developer credentials; agentic capabilities embedded in platforms bought for other reasons; agents in contractor and outsourced environments holding credentials to your repositories; tool-protocol servers exposing internal systems; model endpoints called directly from application code and CI; and agents in the supply chain, since upstream maintainers use them too.

The last three categories are where inventories fail. Any inventory omitting them should carry that caveat explicitly in reporting, because the number will be read as complete.

2.2 What Actually Changes #

Eight properties break existing practice. Each maps to specific material later.

Volume decouples from headcount.

Change arrives at a rate set by compute and budget rather than staffing. Every control sized against human throughput is now sized against the wrong denominator.

Authorship becomes ambiguous.

The commit author, the code owner, the reviewer, and the accountable engineer were historically the same small set of people. They are now potentially disjoint, and the regulatory instruments that assume otherwise have no fallback position.

Untrusted input becomes control flow.

An agent reading an issue, a pull request description, a dependency README, or a tool response cannot reliably distinguish data from instruction. This is a property of the architecture, not a defect awaiting a patch.

Configuration becomes an execution surface.

Across the disclosed vulnerabilities in agentic development tooling, the vulnerable object is repeatedly the configuration file rather than the code.¹⁹^,²⁰^,²¹^,²²

Correctness becomes statistical.

For probabilistic components and for agent behavior itself, there is no input for which output is guaranteed. Binary acceptance criteria do not apply.

The dependency graph acquires a live third party.

A pinned model snapshot still runs on someone else’s infrastructure under someone else’s policy.

Every measurement signal becomes an optimization target.

Once an agent’s success is scored against a signal it can observe, that signal degrades as a measure. This is Goodhart’s law with a much shorter feedback loop, and Section 7.4 gives the measured rates.

Failure becomes early and silent.

In failed agent trajectories, the decisive error occurs at a median of step 7 out of roughly 27, the recovery window is a median of one step, and 82 percent of failures show no termination after the error locks in—the agent keeps working, productively-looking, for the remaining twenty steps.¹¹⁷ Cost is spent after the task is already lost.

2.1 The Population Problem #

2.2 What Actually Changes #

References cited in this section