From SDLC to ADLC: how I orchestrate agents without drowning in PRs

The NBER study on AI coding tools is blunt: commits can triple while releases creep up 30%. The bottleneck moved. It did not vanish.

That matches what I see shipping agent workflows for clients. The teams that win are not the ones with the flashiest codegen demo. They are the ones that redesigned how work flows from prompt to production.

Direct answer: treat agent adoption as a lifecycle redesign, not a plugin install. You are the orchestrator. Agents draft. Automated gates filter. Humans decide on risk. Most diffs should die before they reach a senior reviewer.

SDLC vs ADLC in one table

The name floating around newsletters is Agentic Development Lifecycle (ADLC). The idea is older: when generation gets cheap, verification becomes the product.

CEPR summary of the writing vs shipping gap

Step 1: Guardrails before prompts

Agents inherit whatever repo chaos you already have. Undocumented conventions become hallucinated patterns.

Before you let async agents loose on a service:

• Constitution file or AGENTS.md with non-negotiables (auth model, error handling, banned dependencies)
• Architectural boundaries agents cannot cross without a human flag (payment code, PII tables, infra Terraform)
• Small default scope per agent task. "Build auth" is a wish. "Add email login endpoint with validation tests" is a task

If you already use GitHub Spec Kit , the constitution and clarify steps are your guardrail layer. ADLC assumes that layer exists or something equivalent.

Step 2: Test agents upstream of human review

Traditional post-commit scans are too late when agents land 2,000-line diffs overnight.

High-performing teams I watch deploy testing agents in tight loops:

1. Agent opens a branch
2. CI runs unit tests plus generated edge cases (property tests, fuzz inputs, API contract checks)
3. Static analysis and SAST run automatically
4. Only then does the PR enter the human queue

Sonar's 2026 summit talk framed the false choice well: review everything and humans become the bottleneck; review nothing and quality collapses. The third path is automated first pass, human on decisions.

Focus human eyes on:

• Authentication and authorization paths
• Data retention and PII handling
• Infrastructure and secret management
• Cross-service contracts that agents love to " simplify"

Let linters and coverage gates handle formatting debates.

Step 3: Tiered review and explicit discard

Not every agent diff deserves a 45-minute review. Tier them.

The skill nobody talks about: discard upstream. When generation is nearly free, merging bad code and reverting is expensive. Close the PR. Throw away the branch. Re-run with a tighter prompt.

That is not waste. It is cheaper than production incident response.

Step 4: Orchestration beats tool sprawl

GitLab's CEO calls the downstream pile-up the "AI paradox": faster coding, overwhelmed review and security, no net velocity gain if tools do not share context.

Fragmented stacks force humans to carry state in their heads across Copilot, Cursor, a separate CI vendor, and a manual deploy script. ADLC wants one thread of context from issue to release.

Practical moves for small teams:

• One issue tracker link per agent run (what problem, what done means)
• One CI pipeline definition agents cannot bypass
• One deploy path so "works locally" cannot masquerade as shipped

Claude Code docs and Cursor Cloud Agents are sync and async layers. They are not a lifecycle by themselves.

Step 5: Metrics that match ADLC

If you still celebrate commit count, you will hire more agents and wonder why customers see no difference.

Track:

The 2025 DORA AI capabilities model lists seven capabilities that amplify AI impact. Adoption alone is not on the list. Culture and technical foundations are.

Trust but verify (without theater)

Surveys keep finding the same split: almost everyone uses AI assistants, a large minority still does not trust unverified output. That is rational.

My default policy on client work:

• Agents propose. CI and test agents challenge. Humans approve risk.
• No direct-to-main for autonomous runs. Ever.
• Record which model and prompt produced a merge for rollback forensics

Security shift-left is non-optional when machines write faster than humans read. Dependency confusion, hard-coded secrets, and "temporary" debug endpoints show up in agent diffs constantly. Automated secret scanning on every push is table stakes.

How ADLC pairs with spec-driven workflows

Spec Kit, clarify steps, and task breakdowns are the intent layer of ADLC. Multi-agent fan-out (Antigravity-style parallelism, cloud agents on separate issues) is the execution layer.

Parallelism without shared spec is four conflicting button implementations. ADLC without specs is fast chaos.

Order of operations I recommend:

1. Specify and clarify (human + agent)
2. Plan and task graph
3. Agent implementation with guardrails
4. Automated verification loop
5. Tiered human review
6. Release and monitor

What I would skip

• Mandating AI review of every line when static analysis already covers it
• Async agents on legacy monoliths before you document boundaries
• KPIs tied to tokens spent or LOC generated

Those optimize the wrong stage and recreate the attenuation curve the NBER paper documents.

Takeaway

Writing code approached zero marginal cost. Shipping still has a price measured in reviewer attention, test design, and merge courage.

ADLC is the boring answer: treat agents like junior contributors with infinite energy and uneven judgment. Give them specs, tests, and fences. Let most output die in CI. Save humans for the calls that actually need a human.

If you are rolling out async agents and your merge queue is the new bottleneck, I help teams design ADLC-style guardrails that match how you actually ship. Book a free discovery call and we can walk your pipeline stage by stage.