AI Agentic Coding in a Real Studio: What Changes, What Doesn't

In short: At LabForty, AI coding agents draft code on well-defined tasks, open pull requests and run tests, but people review every change and approve every merge and release. Architecture, security, approvals and client judgement stay human. The gain is more senior time on specs, review and hard problems, not fewer safeguards.

There is a lot of noise about AI writing software. Some of it says developers are finished. Some of it says agents produce nothing but bugs. Neither matches what I see every day.

We use AI coding agents in real client delivery. Cloud agents open pull requests. People review and merge them. Tests run on dev, then main, then production. AI bots help triage support requests. Here is how that works in practice, and where we keep humans firmly in charge. It follows on from our earlier piece on how AI is changing website development.

The delivery loop: spec, agent, PR, tests, review

The unit of work is still a small, well-defined task. What changed is who writes the first draft of the code.

1. Spec. An engineer writes a clear task: the goal, the constraints, the files involved, the acceptance criteria and what must not change. Vague tasks produce vague code, from agents and from people.
2. Agent. A cloud coding agent works on its own branch in an isolated environment. It reads the codebase, makes the change, writes or updates tests and runs them.
3. Pull request. The agent opens a PR describing what it did and why. Nothing reaches a shared branch without one.
4. Tests. Automated checks run on every PR: type checks, linting, unit and integration tests and build checks. The change then moves through dev, main and production, with tests at each step.
5. Human review. An engineer reads the diff, runs it where needed, asks for changes or rejects it. Merging is a human decision.

Engineers spend less time typing boilerplate and more time on specs, review and the hard problems. The work does not disappear. It moves.

What stays human

Some decisions I will not delegate to an agent, however good the model is.

Architecture. How a system is split, where data lives, which services talk to which and how it will scale. An agent can propose options. A senior engineer who knows the client, the budget and the next three years decides.

Security. Authentication flows, permissions, secrets handling, data protection and anything touching payments or personal data. Agents get reviewed harder here, not softer.

Approvals. Merges to main, production releases, database migrations and anything irreversible. A named person approves, and that person is accountable.

Client judgement. Understanding what the client actually needs, which is often different from what the ticket says. That is a conversation, not a prompt.

Developers broadly agree with this split. In Stack Overflow's 2026 Developer Survey, 48% of respondents said they trust AI output when they can easily verify it, while only 6.6% trust it for important work decisions (Stack Overflow, 2026). That matches my experience: agents are strong where results are checkable, and humans own the decisions that are not.

The real risks

Agentic coding has failure modes. Pretending otherwise is how teams get hurt.

• Plausible but wrong code. It compiles, it looks clean and it misses an edge case. Tests and careful review are the defence.
• Scope creep inside a PR. An agent refactors files it was not asked to touch. Large diffs hide problems.
• Weak tests. An agent can write tests that pass because they assert the wrong thing. Reviewers read the tests, not just the green tick.
• Leaked context. Secrets, client data or credentials ending up in prompts, logs or third-party tools.
• Dependency risk. New packages added without anyone checking maintenance, licence or security history.
• Skill drift. If junior engineers only approve agent output, they stop learning how systems work.

Guardrails that work for us

These are the rules that make agentic delivery safe enough for client work.

1. Small tasks, small PRs. One concern per PR. If a diff is too big to review properly, it goes back.
2. Protected branches. Agents cannot merge, deploy or change production configuration.
3. Tests as a gate. Failing checks block the merge. Coverage of critical paths is reviewed by people.
4. Least privilege. Agents run in isolated environments with only the access the task needs. No production secrets.
5. Staged promotion. Dev, then main, then production, with checks at each stage and a clear rollback path.
6. Written project rules. Coding standards, architecture notes and "do not touch" lists live in the repository, so every agent run starts from the same context.
7. Review ownership. Every PR has a named reviewer. "The AI did it" is never an explanation.

Governance often lags usage. In the same survey, only 24% of developers said their organisation publishes approved AI tools or an official AI policy (Stack Overflow press release, 2026). If you buy software from a studio, ask to see theirs.

What this means for clients

For our clients, agentic coding shows up as faster iteration on well-defined work, more senior engineering time on the parts that matter and better test coverage, because writing tests is cheaper now.

It does not mean cutting corners. Review, security and accountability still cost real engineering time, and they should. That applies whether we are building a website, a mobile app or a custom CRM.

The same principle runs through the AI we build for clients. Our custom AI agents prepare work and route exceptions, and your team approves important results before they move on. If your data cannot leave your environment, we can run the models on your own servers.

FAQ

Do AI agents write production code at LabForty?

Agents draft code on well-defined tasks in isolated branches. Every change goes through a pull request, automated tests and review by an engineer, and a person approves merges and releases.

Is client code or data sent to AI tools?

Agents run with least-privilege access and no production secrets. Which tools may see which client material is agreed per project.

Does agentic coding make projects cheaper?

It makes well-defined work faster and testing cheaper. Review, security and accountability still take senior time, so the main gain is speed and quality on the right tasks, not a lower bar.

What should I ask a studio about its AI use?

Who reviews each change, who approves releases, what client data goes into AI tools and whether there is a written AI policy. Specific answers are a good sign.

Talk to a senior team

If you want to see how a senior team runs AI-assisted delivery with proper guardrails, from web platforms to fintech products, send us a short brief. We reply within 24 to 48 hours on working days.