Service 02 / Agentic SDLC Transformation

Anonymised client

Moving an energy software unit to an agentic SDLC.

How an energy software unit went from AI-assisted coding to an agentic lifecycle, from incident to release, without loosening the controls that auditors and regulators expect.

BEFORE PLAN DESIGN BUILD TEST DEPLOY MAINT AFTER PLAN DESIGN BUILD TEST DEPLOY MAINTAIN
Organisation
Software unit of a renewable-energy company
Scope
Integrations between renewable assets, data platforms and enterprise systems
Context
Regulated environment with critical-infrastructure and change-management obligations
Service
Agentic SDLC Transformation

The problem

Faster code, same manual lifecycle.

Energy software teams maintain complex integrations between renewable assets, data platforms and enterprise systems. When something breaks, engineers spend hours reading logs, fixing code, testing the change and coordinating a release.

AI coding assistants help them write code faster. The rest of the lifecycle stays largely manual: requirements, review, testing, release and the follow-up after an incident. The queue moves from writing code to everything around it.

The solution

One continuous, AI-supported workflow.

We implement an agentic SDLC that connects planning, development, testing, deployment and maintenance. AI agents investigate issues, prepare changes, write code, run tests and perform reviews. Automated controls enforce engineering standards, while people approve the critical decisions and every production release.

  • Every stage commits an artifact that the next stage reads, so the commit history is also the audit trail.
  • Agents work inside guardrails: protected paths, secret scanning, policy checks in the pipeline.
  • People accept intent, accept the plan and approve the release. Agents never decide those.

Use case

A solar plant stops sending production data.

An API change on the plant vendor’s side breaks the integration, and production data stops flowing into the data platform. Here is how the same incident plays out in each model.

  1. TraditionalAgentic
  2. DetectTraditionalSomeone notices missing data, often late, from a dashboard or a downstream report.AgenticMonitoring detects the gap and opens an incident, drafted as an intent for a person to accept.
  3. DiagnoseTraditionalAn engineer reads logs and compares API versions by hand to find the change.AgenticAn agent reads the logs and the vendor’s change notes, identifies the API change and attaches the evidence.
  4. FixTraditionalThe engineer updates the integration from their own knowledge of the codebase.AgenticAgainst an accepted plan and the shared project context, the agent writes the change on a branch.
  5. TestTraditionalManual tests, sometimes against live data.AgenticTests run as the work happens, including a replay of the failed payloads and a new contract test for the API.
  6. ReleaseTraditionalA change request, a manual review and a manual deployment.AgenticAgentic review checks the diff against the plan. A person approves the release, and the pipeline enforces policy checks.
  7. LearnTraditionalThe fix lives in a ticket and in someone’s memory.AgenticThe incident, the fix and the new test are committed, and the skill for this integration is updated.

The control model

Control follows risk.

We do not apply one rule to every system. The software estate is classified into three tiers. The loop is the same in all of them; what differs is where a person must decide.

  1. 01

    Tier A — internal tools and portals

    Agents plan, build, test and do first-pass review. People accept intent and design, and sample merged work.

  2. 02

    Tier B — settlement and regulatory reporting

    Agents build, but a person reviews and approves every release, and tests are held to a higher bar.

  3. 03

    Tier C — operational-technology-adjacent

    Engineers write the code. Agents help with tests and reading, never with changes to protected paths.

  4. 04

    Every tier

    A person accepts the intent and the design before build starts. Every stage commits an artifact, and the commit history is the audit trail.

PLAN DESIGN BUILD TEST DEPLOY MAINTAIN TIER Ainternal tools and portals Agents lead. People sample releases. TIER Bsettlement and regulatory reporting Agents build. A person approves every release. TIER Coperational-technology-adjacent Engineers write code. People approve every gate.

Person approvesPerson samplesAgent worksPerson writes

What we put in place

Artifacts and guardrails, not just tools.

  • A shared project context file per repository, and a library of reusable skills for security, architecture and testing standards.
  • Hooks that block edits to protected paths, stop secrets leaving the repository and keep the plan in step with the code.
  • Azure DevOps or GitHub integration for pull-request review, required approvals and pipeline policy checks.
  • Monitoring wired to the loop, so an alert opens an incident that becomes the next intent.
  • An evaluation suite for the agents’ own skills, plus enablement for engineers and product owners.

Rollout

Four phases, starting small.

  1. 01AssessAbout 4 weeksDelivered: an SDLC maturity assessment across the engineering teams, the tier classification and a baseline for cycle time and rework.
  2. 02PilotAbout 10 weeksDelivered: two teams, one Tier A and one Tier B, working in the new loop with the guardrails live.
  3. 03ExtendPer waveDelivered: the configuration, skills and pipeline policies rolled out wave by wave, informed by the pilot data.
  4. 04OwnOngoingDelivered: a platform team that maintains skills and evaluations, and a quarterly review of the tier model.

Durations are indicative. Tier C code was kept out of the pilots.

What we track

Cycle, rework and risk, against the baseline.

  • Elapsed time from the first intent to production, read from version-control history.
  • Rework: specification changes made after the plan is committed.
  • Pull-request review turnaround and the share of changes merged from the first implementation pass.
  • Change failure rate and escaped defects, so speed is never bought with quality.

The measures were agreed in the Assess phase and are reported against the baseline. We do not promise performance gains up front.

Contact

Ready to make AI operational?

Whether you are starting with one team or an entire engineering organization, let’s discuss where an agentic lifecycle would pay off first.

Email
contact@core.ai
LinkedIn
linkedin.com/company/coreai-dk
Location
Copenhagen, Denmark