AI coding agents now take a ticket, work in their own branch or cloud sandbox, run the tests and open a pull request for a human to review. That moves the bottleneck from writing code to reviewing it, makes specs and tests the real interface to your codebase, and raises the value of senior judgment rather than lowering it. Teams that roll agents out on top of good engineering habits get faster; teams that skip the groundwork ship more change and more breakage.
What AI coding agents do now
The jump from autocomplete to agents is that the tool now owns a whole task loop. Three products show what that looks like, described here only as their own documentation describes them this week.
- Claude Code. Anthropic's documentation describes it as an agentic coding tool that reads your codebase, edits files and runs commands, in the terminal, IDE, desktop app and browser. It stages changes, writes commit messages, creates branches and opens pull requests, and in CI it can automate code review and issue triage through GitHub Actions or GitLab CI/CD. A CLAUDE.md file in the repo root carries your coding standards and review checklists into every session.
- OpenAI Codex. OpenAI's Codex cloud docs say each task gets its own workspace in a cloud environment that installs your dependencies and tools, and can keep working while your computer is asleep. You review the changes and test results, then commit or open a pull request when ready.
- GitHub Copilot cloud agent. GitHub's docs now call this Copilot cloud agent, though some doc URLs still say coding agent. Per GitHub's docs, it works in an ephemeral cloud development environment, runs tests and linters, works on one branch at a time and opens one pull request per task, with a 59-minute session limit.
The common pattern matters more than the vendor. A developer, or a scheduled job, hands the agent a task. The agent returns a diff with a description. A person decides whether it merges.
What the research says about adoption and trust
Usage is already near universal, and trust is not. Google's 2025 DORA State of AI-assisted Software Development report, based on survey responses from nearly 5,000 technology professionals, found that 90% use AI at work and more than 80% believe it has increased their productivity. Yet 30% report little or no trust in the code AI generates.
The most useful DORA finding for a CTO is about delivery. AI adoption now shows a positive relationship with software delivery throughput, but it continues to have a negative relationship with delivery stability. DORA's own framing: AI does not fix a team, it amplifies what is already there.
The Stack Overflow 2025 Developer Survey tells the same story from the developer's chair. 84% of respondents use or plan to use AI tools, and 47.1% use them daily. Only 3.1% highly trust the accuracy of AI output, while 45.7% somewhat or highly distrust it. The top frustration, cited by 66%, is output that is almost right but not quite, and 45.2% say debugging AI-generated code takes more time.
Agents specifically are earlier in the curve. In the same survey, 14.1% use AI agents at work daily and 9% weekly, while 37.9% say they have no plans to. Most of your engineers have opinions about AI in the editor. Far fewer have managed an agent that opens pull requests unsupervised.
What changes for your engineering team
Review becomes the bottleneck
An agent can produce five pull requests before lunch. Your reviewers cannot read five times faster. If you add agents without changing review, the queue grows, reviewers skim, and the instability DORA measured shows up in your incident log. Plan review capacity before you plan agent capacity.
Specs and tests become the interface
An agent is only as good as the task it receives and the checks it has to pass. A vague ticket produces a plausible diff that solves the wrong problem. A ticket with acceptance criteria, an example input and output, and a failing test produces something a reviewer can verify in minutes. Test coverage stops being hygiene and becomes the main way you tell an agent what correct means.
Senior judgment matters more, not less
Someone has to decide which tasks are safe to delegate, notice when a passing test suite is testing the wrong thing, and reject a clean-looking change that quietly breaks an architectural boundary. That is senior work. DORA's finding on user-centric focus makes the same point at team level: without it, AI-assisted teams may just move quickly in the wrong direction.
Junior work shifts
The tickets that used to train junior engineers, such as small bug fixes, test backfills and dependency bumps, are exactly what agents take first. Juniors still need a path to judgment. Give them agent output to review against a checklist, pair them with a senior on the hard reviews, and have them write the specs and tests that agents work from.
A 30/60/90-day rollout plan for AI coding agents
Late October is a good moment to start. A pilot that begins now gives you real numbers before 2027 budgets close and before Q1 roadmaps lock.
Days 1 to 30: prepare one repo
- Pick one service with good test coverage, a clear owner and low blast radius. Not your payments path.
- Write the agent instructions file (for example CLAUDE.md or AGENTS.md): build and test commands, style rules, folders that are off limits, how to describe a pull request.
- Turn on branch protection and required checks for that repo if they are not already on.
- Record a baseline: median time from pull request opened to merged, change failure rate, and how many pull requests wait more than a day for review.
- Choose three or four engineers, including at least one senior reviewer, to run the pilot.
Days 31 to 60: delegate bounded work
- Start with test backfills, lint fixes, small bugs with a reproduction, and dependency updates.
- Require every agent task to start from a ticket with acceptance criteria. No ticket, no agent.
- Keep agent pull requests small. DORA's research singles out working in small batches as one of seven capabilities that amplify AI's benefits.
- Review every agent pull request with the same bar as human code. Log what reviewers reject and why; that list becomes your next round of instructions.
Days 61 to 90: measure, then widen
- Compare against the baseline. If throughput rose and change failure rate held, add a second repo. If failures rose, fix tests and review before expanding.
- Add an AI reviewer pass as a first filter if it helps, but keep a human approval required.
- Write a one-page policy: which repos, which task types, who may trigger agents, who approves.
- Budget review time explicitly in sprint planning instead of hoping it fits.
Checklist before agents open pull requests in your repos
- Repo hygiene. One-command build and test, documented setup, an agent instructions file, and no flaky tests that teach everyone to ignore red builds.
- Test coverage. Meaningful tests on the paths agents will touch, run in CI on every pull request. Coverage gaps are where plausible but wrong code slips through.
- Review rules. A human approval on every agent pull request, and the person who asked for the change is not the only approver. GitHub's Copilot cloud agent mitigations enforce this by default: the requester cannot approve the pull request, and the agent cannot approve or merge its own work.
- Permissions. Agents push to their own branches only, and only people with write access can start them. Keep version control strong; DORA found frequent use of rollback boosts the performance of AI-assisted teams.
- CI and workflows. Decide whether workflows run automatically on agent code. GitHub's default holds them until someone with write access approves the run.
- Secrets and network. No production credentials in agent environments, scoped tokens only, and restricted internet access. GitHub restricts its agent's internet access by default; match that elsewhere.
- Metrics. Track review time, change failure rate, rework rate and time to restore service, split by agent-authored and human-authored changes.
- Ownership. Every merged change has a named human owner who answers for it in an incident review.
Common mistakes
- Measuring pull requests opened instead of changes that reached production without rework.
- Rolling out agents org-wide in one step, before any repo has the tests and review rules to absorb them.
- Cutting senior headcount because agents write code, then discovering nobody has time to review it.
- Letting agents run against shared environments with broad credentials because it was faster to set up.
If you are also weighing how outside engineers fit with agents, our earlier post on staff augmentation in the AI era covers the staffing side. This playbook is about the workflow inside your repos.
How Ryz can help
The hard part of AI coding agents is not the license, it is the senior engineers who write good specs, keep tests honest and review agent output with judgment. Ryz brings top 1% senior software engineers who already work this way and join your team on US business hours, and AI pod teams that build and ship AI systems inside your cloud and repos. Most engineers ship in their first week, you own all code and IP, and senior engineers run $10,000 to $15,000 per engineer per month. Ryz engineers work on your team, reporting to your leads. Talk to us to scope your team.
FAQ
Are AI coding agents ready for production codebases?
For bounded tasks in repos with good tests and strict review, yes. DORA's 2025 research links AI adoption to higher delivery throughput but also to lower stability, so the safeguards matter more than the tool. Start with one repo and expand on evidence.
Which metrics show whether coding agents are helping?
Track time from pull request opened to merged, change failure rate, rework rate and time to restore service, split by agent and human authorship. If throughput rises while change failure rate holds steady, widen the rollout. If failures rise, fix tests and review first.
Do coding agents mean we need fewer senior engineers?
Usually the opposite. Agents produce more code to review, and deciding what to delegate, catching subtle design problems and owning incidents are senior skills. Teams often need more review capacity, plus QA automation engineers who keep the test suite trustworthy.
How do forward-deployed engineers fit with coding agents?
A forward-deployed engineering team works inside your cloud and repos and can set up the agent instructions, tests, review rules and metrics described here, then hand the system to your team when it is running well.
