Verified intelligence · Expert-reviewed from public records, platform data, primary sources, and private research beyond AI search.

AGENTSTechnologyGLOBAL

AI agents for software engineering

Software-engineering AI agents should be bought against accepted delivery: PR acceptance, CI authority, review capacity, rollback ownership and usage cost after failed attempts.

The colophon

Landscape reviewed: 2026-06-16
Latest revision: 2026-06-17
Kinetics: Coding-agent budgets are shifting from developer-seat productivity claims to delivery-system evidence: accepted pull requests, review load, delivery failures and recovery work. Benchmark audits, cloud-agent permissions and agent-security incidents can change what counts as credible delivery evidence within a quarter.
To watch: 1 August 2026: Black Hat USA 2026 opens with Briefings and Arsenal programming; new coding-agent, MCP, supply-chain or prompt-injection research would change negative fixtures for software-agent approval ⁸³.
7 August 2026: DEF CON 34 Cloud Village opens; cloud identity, metadata-service, egress or managed-agent research would change hosted-agent runtime and secrets approval ⁸⁴.
Known unknowns: The missing artefact is independent longitudinal production telemetry linking coding-agent work across private repositories, secrets, workflow-file edits, CI/CD, human review, deployment gates, recovery work and post-merge defects.

Contents

Executive summary
Decision map
Accepted-change route
Provider lanes
Context and access
Benchmarks and private evals
Workflow playbooks
Economics and productivity
Security control plane
Contract and deployment controls
Operating model
Implementation cases
Risk and reapproval
Operational exhaust
Known unknowns
Recommended next steps
Expert watchlist
Agentic coding tool directory
Source record
Glossary

▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒Executive summary

The expensive failure is unclear authority after a pull request looks acceptable. Coding agents fail at the boundary between PR acceptance, CI authority and rollback ownership. A coding agent can produce a plausible diff, open a pull request and still leave the buyer with the wrong proof. The hard question is who accepted the change, which CI evidence counted, which deployment gate stayed outside the agent's reach and who owns rollback.

The productivity record is mixed enough to make that distinction valuable. Controlled Copilot studies show speed and quality gains on bounded tasks ¹⁹²⁰. METR found experienced open-source developers took longer on AI-allowed real tasks ³⁴.

GitHub's cloud-agent workflow shows why the metric moved. Copilot can work in an ephemeral Actions environment, create branches and pull requests, and expose PR lifecycle metrics, but GitHub still tells reviewers to inspect work before merging ⁴⁵.

The useful screen is accepted delivery after review, CI and rollback. Delivery failures and recovery time belong in the metric set ³⁹. Usage cost belongs beside review and retry labour ⁶².

Benchmarks are useful but insufficient. SWE-bench Verified made real-issue patch evaluation more concrete; OpenAI later stopped reporting it because flawed tests and benchmark exposure weakened its signal for frontier agents ²²²³. DevOps-Gym and GitTaskBench move the question toward build, monitoring, repository setup and dependency failures ⁵³⁵⁴.

The operating rule is software-native: separate PR acceptance from CI authority, deployment authorization and recovery ownership. Routine docs, tests, refactors and low-risk bug fixes can move first. Workflow-file edits, dependency changes, secret-touching code, release automation, migration scripts and production deploys need stricter gates.

Classify each agent by the delivery authority it touches: repository read scope, file-write surface, command rights, pull-request role, CI mutability, deployment exposure and rollback owner.

Agent authority tree

Screen the delivery boundary before screening the vendor.

Is the agent only reading approved repositories and documentation?
Yes
Allow with repository-scope logging, source citation and no write access.
No
Classify the write path.
Next: Q2 write
Can it edit files, run commands or change dependencies?
Yes
Require sandbox boundary, command allowlist, diff review and dependency provenance.
No
Keep as advisory assistant.
Can it open or update a pull request?
Yes
Require branch protection, reviewer independence, CI source controls and PR evidence export.
No
Treat output as local proposal.
Can it touch workflow files, secrets, production config or deployment paths?
Yes
Block by default; approve only under a named high-risk route with security owner, deployment drill and rollback owner.
No
Run route-specific private eval before expansion.

The approval tree treats coding agents as contributors whose rights must match the route.

Accepted delivery breaks across five boundaries

Boundary	Buyer question	Proof to demand	Stop sign
PR acceptance	Who accepted the diff and evidence file?	Independent reviewer, code-owner rule, latest-push approval, changed-file class and PR lifecycle metrics.	Agent approves, merges, or causes stale approvals to count.
CI authority	Can the agent alter the checks that prove acceptance?	Expected status-check source, branch rule, workflow-file restriction, runner policy and scan result.	Agent weakens tests, changes workflow files or controls the evidence system.
Deployment gate	Can accepted code reach protected environments or secrets?	Environment approval, branch/tag restrictions, resource-owner checks and secret scope.	Merge approval is treated as production approval.
Rollback ownership	Who handles a bad accepted change?	Rollback playbook, incident link, recovery-time metric and post-merge defect attribution.	Agent closes incident, fabricates recovery evidence or suppresses alerts.
Economics	Did delivery improve after review, retries and usage cost?	Accepted changes per review hour, premium requests, credits, ACUs, CI minutes, rework and recovery time.	Seat price, generated lines or benchmark rank becomes the investment case.

Use the table to decide which agent rights are worth expanding.

Choose the right approval route before comparing agents. Coding agents sit in five lanes, and each lane has a different control point. IDE agents start with a local diff. Terminal agents add a command log. Cloud issue-to-PR agents add a branch and pull request. Code-review agents change the reviewer role. Source-control and platform agents add CI gates and deployment exposure.

Approve each lane separately because its context, command and pull-request boundaries differ. Claude Code's write restrictions and permission prompts, GitHub Copilot cloud agent's PR route, Jules's GitHub-integrated task handling, Junie's operation approvals and GitLab Duo's tool-approval architecture are all different operating boundaries ⁴⁸⁹¹³¹⁵.

Use the map to choose who owns the risk: developer, platform engineering, AppSec, release engineering, code owner or incident commander.

Five lanes, five approval files

Lane	What it does	Natural gate	Approve first	Do not approve yet
IDE pair agent	Edits local files, explains code, proposes changes and may run local commands.	Developer-owned diff and command approval.	Tests, docs, small refactors and local prototypes.	Secrets, workflow files, production config and broad filesystem access.
Terminal agent	Plans, edits, runs shell commands and iterates in a project workspace.	Command allowlist, sandbox and log evidence.	Bounded tasks with reversible commands and explicit tests.	Destructive commands, deployment commands and unscoped package changes.
Cloud issue-to-PR agent	Researches a repo, creates a branch and opens or updates a pull request.	Branch protection, review independence and CI-source controls.	Issues with clear acceptance criteria and reviewable diffs.	Auto-merge, uninspected workflow runs and changes that alter the review system.
Code-review agent	Reviews PRs, comments on changes and may request fixes.	Reviewer role, comment provenance and human endorsement.	Second-pass comments, static-risk hints and checklist coverage.	Replacing code-owner review or approving its own work.
Platform workflow agent	Touches CI/CD, source-control APIs, deployment automation, alerts or incident tasks.	Security owner, least privilege and rollback proof.	Read-only diagnostics and low-risk auto-fixes.	Deployment, secret rotation, workflow mutation or incident closure without human gate.

Terms used in this report

Term	Plain meaning
Route	The approved path from work to accepted output: source set, data boundary, model or vendor channel, tools, reviewer, evidence record and reapproval trigger.
API	Application programming interface: a governed software connection used by an app or workflow to call a model or service.
LLM	Large language model: a model trained to read and generate text-like tokens.
Token	A chunk of text used for billing, context windows and rate limits. It is usually smaller than a word, not a page count.

Definitions are reader aids, not separate evidence claims.

MCP PREVIEW INVENTORY

What the locked report contains

Software-engineering AI agents should be bought against accepted delivery: PR acceptance, CI authority, review capacity, rollback ownership and usage cost after failed attempts.

Schema endpoints

Sample object: /api/v1/reports/RPT_AI_AGENTS_SOFTWARE_ENGINEERING_2026_06/sample
Inventory object: /api/v1/reports/RPT_AI_AGENTS_SOFTWARE_ENGINEERING_2026_06/inventory
Schema contract: /api/v1/reports/RPT_AI_AGENTS_SOFTWARE_ENGINEERING_2026_06/schema

Coverage fields

Category: AGENTS
Sector: Technology
Region: GLOBAL
Topics: software-engineering AI agents, coding agents, agentic software development, pull request approval, workflow approval, developer productivity, software supply chain, secure software development, MCP security, coding benchmarks, private evals, CI/CD governance, branch protection, repository permissions, developer platforms

Schema contract

Contract: colophon.report_document v2026-05-28
Payload schemas: document, summary, sample, inventory, full_report
Required top-level fields: title, subtitle, abstract, category, sector, region, topics, sources, evidence, claims, colophon, body
Integrity rules: evidence.sourceId must reference sources[].id claim.evidenceIds[] must reference evidence[].id evidence.claimIds[] must reference claims[].id section and block evidence references must resolve colophon.kinetics.speed must match the momentum band for the business impact x momentum model

Data-point inventory

vendor_or_actor_ledger: entity names; product categories; source references; confidence notes
buyer_decision_fields: pricing signals; deployment constraints; risk flags; monitoring fields
evidence_index: source class; access date; claim linkage; verification status

Section inventory

1. Executive summaryPreview
decision-ready conclusions; major findings; confidence caveats
2. Decision mapPreview
selection criteria; tradeoff map; recommended buyer actions
3. Accepted-change routeLocked
structured findings; supporting evidence; buyer-use fields
4. Provider lanesLocked
structured findings; supporting evidence; buyer-use fields
5. Context and accessLocked
structured findings; supporting evidence; buyer-use fields
6. Benchmarks and private evalsLocked
structured findings; supporting evidence; buyer-use fields
7. Workflow playbooksLocked
structured findings; supporting evidence; buyer-use fields
8. Economics and productivityLocked
structured findings; supporting evidence; buyer-use fields
9. Security control planeLocked
structured findings; supporting evidence; buyer-use fields
10. Contract and deployment controlsLocked
structured findings; supporting evidence; buyer-use fields
11. Operating modelLocked
structured findings; supporting evidence; buyer-use fields
12. Implementation casesLocked
structured findings; supporting evidence; buyer-use fields
13. Risk and reapprovalLocked
structured findings; supporting evidence; buyer-use fields
14. Operational exhaustLocked
structured findings; supporting evidence; buyer-use fields
15. Known unknownsLocked
structured findings; supporting evidence; buyer-use fields
16. Recommended next stepsLocked
structured findings; supporting evidence; buyer-use fields
17. Expert watchlistLocked
structured findings; supporting evidence; buyer-use fields
18. Agentic coding tool directoryLocked
structured findings; supporting evidence; buyer-use fields
19. Source recordLocked
normalized entity rows; source ledger; evidence-to-claim mapping
20. GlossaryPreview
structured findings; supporting evidence; buyer-use fields

Relevance signals

Confidence score: 0.87
Source classes: official_coding_agent_docs, model_system_card, source_control_agent_docs, source_control_governance, ci_cd_security_docs, coding_agent_vendor_docs, agent_platform_architecture, code_search_permission_docs, developer_survey, productivity_study, software_delivery_research, software_delivery_metrics, coding_agent_benchmark, benchmark_limitation, agent_benchmark, agent_benchmark_paper, security_standard, secure_software_standard, software_supply_chain_standard, research_paper, independent_productivity_study, ci_cd_approval_docs, security_research, coding_agent_vendor_limitations, pricing_docs, application_security_docs, independent_capability_study, incident_database, sandbox_infrastructure_docs, security_guidance, operational_status_page, security_event_schedule, open_source_coding_agent_docs, market_survey
Known unknowns: The missing artefact is independent longitudinal production telemetry linking coding-agent work across private repositories, secrets, workflow-file edits, CI/CD, human review, deployment gates, recovery work and post-merge defects.
Watch signals: 1 August 2026: Black Hat USA 2026 opens with Briefings and Arsenal programming; new coding-agent, MCP, supply-chain or prompt-injection research would change negative fixtures for software-agent approval [[E83]]. 7 August 2026: DEF CON 34 Cloud Village opens; cloud identity, metadata-service, egress or managed-agent research would change hosted-agent runtime and secrets approval [[E84]].

Locked continuation

Purchase or subscribe to unlock the full findings, evidence ledger, and buyer-ready recommendations.