AI governance in AI-native software engineering at scale

Last updated: October 7, 2026

Contributing expert: Vittesh Sahni, Senior Director of AI Engineering

Max Belov, Chief Technology Officer

When AI is integrated into a software delivery system, the pace picks up. Code is written faster, tests are created automatically, and documentation is updated. However, the underlying processes and workflows (review, validation, quality checks, and compliance) that support coding, testing, and documentation were not made for AI’s speed. The gap between AI-assisted tasks and traditional delivery systems is especially pronounced with governance. In traditional systems, governance was designed for teams working at a human pace, but with the addition of AI, those guardrails can slow things down or cause teams to miss important issues.

Teams that bypass governance not only slow down; they also lose accountability. The loss of speed and accountability can lead to costly delays, wasted resources, and communication breakdowns between teams and stakeholders.

To bridge the gap between AI-generated work and the supporting delivery system, Coherent Solutions developed the Continuous Delivery Loop (CDL). CDL is an operating framework for AI-native software delivery; it structures delivery into ongoing feedback loops across four main areas: Problem Identification, Validation & Exploration, Design & Engineering, and Observation & Scale. Governance is built into these loops as a core part of the process, not added afterward.

This article explains how CDL works in practice, covering how CDL builds accountability into AI-native engineering, and why treating governance as code helps it scale.

Why governance is critical as AI scales

In digital engineering, traditional governance separates policy from delivery. The policies and processes meant to support delivery — security review, compliance sign-off, quality gates — sit with teams outside the delivery workflow and are applied as a review layer at the end of it, rather than integrated into the entire software development lifecycle. Because those checks arrive after the build decisions have already been made, problems surface too late and can drive delays and misalignment. As a result, engineering teams may have to redo work if security and compliance are only checked at the end.

In a recent report, Forrester cited a Canadian wealth and asset management firm that skipped compliance governance at the start of its agentic AI initiative, only to call it a mistake once the rework costs became clear. Retrofitting accountability after the fact doesn’t just create audit gaps; it forces teams to renegotiate decisions already in production.

Improving delivery with AI is not just about automating tasks but also about redesigning workflows, roles, and how teams work together. Governance is a crucial area where this redesign either succeeds or fails.

The AI-native inflection point

AI-native engineering accelerates the entire delivery system. If governance cannot keep up, this speed increases risk instead of value. Regulatory pressure adds another challenge. As AI handles more work, audit trails, approvals, and quality checks cannot be added at the end of the lifecycle — they must be built in from the start. The goal is not to slow down delivery, but to integrate governance throughout the delivery system, so that accountability grows with output.

Governance as Code: how CDL enforces accountability

With CDL, governance policies must be written and stored as executable artifacts, alongside software artifacts. They are versioned, testable, and auditable just like production code. The governance policies are also kept in the AI Playbook — CDL’s living, governed source of truth, holding the standards and conventions, orchestration patterns, role-scoped prompts, governance hooks, and proven architectural decisions that teams draw on when working with AI. It is managed like production code, with branches, pull requests, reviews, versioning, and deprecation, by the AI Champions who maintain it. When a governance rule changes, it’s updated once and spread to every team that uses it. This makes governance an active part of the delivery system, not just an extra layer.

Seven CDL-driven enforcement points where Governance as Code operates

1. Code review

In the CDL framework, teams use AI to review changes before they go to human reviewers. This helps manage the large volume of AI-generated code while preserving human judgment. Governance sets the rules for what needs escalation, who gives final approval, and under what conditions. These rules are uniformly enforced across all delivery teams.

2. QA

Instead of adding test coverage at the end, CDL creates and runs tests with every code change. Acceptance criteria are included from the beginning. Governance defines what “done” means before each cycle ends, so quality is checked throughout, rather than just at the finish.

Coherent used this approach across its QA organization, which included 360 engineers across nine countries. QA teams used AI to redesign test documentation, regression, and analysis workflows. As a result, test-case writing effort dropped by 50%, documentation speed increased by 60%, and test coverage improved by 35%. Engineers remained responsible for decisions and validation at every step.

3. Security

With CDL, security and software supply chain checks, licensing and IP rules, sensitive data filters, and audit logging are run on every AI action within the agent loop, one of the framework’s key feedback loops. This ensures that essential security functions are embedded throughout the lifecycle, not just during the deployment and maintenance phases. This approach also creates a traceable record that can help teams quickly identify and resolve security issues, avoiding costly rework.

4. Human gates

CDL workflows clearly define when humans need to make decisions. In practice, that responsibility falls to team leads, as they are closest to the work and best positioned to judge how much AI autonomy is appropriate given the specific risk and context. As Coherent explored in a recent Forbes Technology Council piece, a CTO can define strategy, tools, governance, and broad policy, but it is the team lead who determines how each element is applied in a specific situation. Governance decides which decisions need human approval, who has that authority, and how it is tracked. This keeps accountability clear as AI takes on more responsibility.

5. Architecture

CDL codifies architectural standards and constraints as governance artifacts, so AI-generated work stays within established system boundaries. Where code review operates at the line level, architecture enforcement operates at the system level, ensuring that AI output conforms to the patterns, integrations, and structural decisions the team has already made.

6. Systems

The requirements and specifications that define what a team is building — epics, user stories, acceptance criteria, and product scope — do not live in the delivery pipeline. They live in the source-of-truth systems where work is defined and tracked. Pipeline-level rules that govern how work moves through the workflow are handled by the enforcement points above; this point is about staying tied to what the work was supposed to deliver. CDL connects governance to these systems so that what is being built remains traceable back to the original product goals and scope. This helps close the gap between intent and execution as AI accelerates output.

7. Learning

CDL’s feedback loop structure supports continuous improvement in governance. Lessons learned from each delivery cycle are captured and fed back into the AI Playbook, so policies stay current and evolve as the team’s experience with AI-native delivery grows. The learning element is especially crucial to scalable governance, as it helps streamline the complexity of a growing delivery system.

Who governs the governance?

Governance policies are only as reliable as the people maintaining them. To help regulate the purpose and scope of governance across stakeholders and delivery teams, CDL assigns clear ownership in three key roles:

• AI Council: Manages standards and oversees all programs.

AI Council: Manages standards and oversees all programs.

• AI Champions: Owns the Playbook and leads execution in the field.

AI Champions: Owns the Playbook and leads execution in the field.

• Applied AI Experts: Builds and improves the tools and methods both teams use.

Applied AI Experts: Builds and improves the tools and methods both teams use.

Without named owners, governance policies drift. Rules go stale as tools and models change, teams interpret the same standard differently, and no one is accountable when a policy stops matching how work is actually done, which is how audit gaps reopen.

Assigning these three roles keeps the Playbook current, keeps enforcement consistent across delivery teams, and gives stakeholders a clear escalation path when a rule needs to change. Governance stays a living part of the delivery system rather than a document written once and forgotten.

The payoff

In a human-in-the-loop delivery system, governance should help people and AI work better, not slow them down. It should provide traceability, consistency, and clear accountability, so teams can make confident decisions. When governance is built into ongoing feedback loops, insights stay reliable and consistent as things change. This allows for faster decisions without risking revenue, security, or operations.

In projects using CDL, Coherent has seen an average 30% increase in delivery performance compared to non-CDL projects. CDL provides the necessary structure to ensure that governance is built into the delivery system, rather than being added later — marrying speed and accountability. This combined effect drives lasting Digital Value Creation, aligning AI to business value and efficient, scalable growth.