AI SDLC — Stage tooling map
Version: 1.0.0
Date: 2026-07-29
Status: Working standard — operator map
Purpose
For each major delivery stage, name the AIES tools to run and how AI is leveraged — so teams stop guessing between a prompt, a skill, a pattern, and a chat.
Why
Prompts without a stage produce theater. Stages without tools produce “we use AI.” This page is the binding: stage → artifact → human gate.
How to use
- Identify the current stage (left column).
- Open the primary prompt.
- Activate the skill when the Why column matches.
- Escalate to a pattern when the change is consequential (multi-file, AuthZ, cutover, SEV).
- Keep MCP empty until MCP when and how allowlists it.
Major stages → tools
| Stage | How AI is leveraged | Primary prompt | Skill(s) | Pattern (when consequential) | Human gate |
|---|---|---|---|---|---|
| Idea / research | Structure options; surface risks — does not decide product | (workflow Idea) + story draft | Planning | — | Product owner locks problem |
| Requirements / DoR | Turn intent into testable AC | Story kickoff | Context | Context | Definition of Ready |
| Context pack | Curate trusted evidence for agents | Kickoff context list | Context · Security | Context | Trust labels reviewed |
| Planning | Decision-complete execution contract | Implementation plan | Planning · Architecture | Planner | Named plan approval |
| Architecture | Scenario-governed topology / ADR | Architecture review | Architecture · Security | Architecture | ADR + rejected alternatives |
| Coding | Implement only against approved plan | Coding | Stack cookbook skill | Planner → Coder handoff | Diff stays inside planned paths |
| Self / agent review | Severity-calibrated findings | Coding self-review + Reviewer pattern | Code review | Reviewer | Human owns merge |
| Testing | Generate failing-first coverage | Test generation | Testing | — | Tests gate merge |
| Security | Threat pass on AI-touched paths | Security review | Security | Reviewer / Enterprise | Block on Critical/High |
| Performance | Profile-guided changes | Performance review | Performance | Optimization | Baseline before change |
| Docs | Capture decisions humans will need | Documentation | Documentation | — | Docs in DoD |
| Release | Progressive expose + abort | Release | DevOps · Evaluation | Release | Abort owner named; eval gate |
| Incident / hotfix | Contain first; smallest reversible change | Incident | Debug · DevOps · Security | Hotfix | IC named |
| RCA / learn | Evidence-bound cause + follow-ups | Root cause analysis · Knowledge capture | Debug · Documentation | Root Cause | Follow-up owners |
| Migration / legacy | Phased cutover or strangler | Migration | Planning · Testing · DevOps | Migration · Legacy | Rollback owner per phase |
| Enhance harness | Fit kit to this repo | Enhance repo · create-prompt/skill/agent | — | — | PR review of harness diffs |
How AI is leveraged (rules of engagement)
| Leverage | Allowed | Forbidden |
|---|---|---|
| Draft | Plans, tests, docs, review findings | Silent merges |
| Accelerate | Boilerplate inside an approved plan | Inventing AuthZ or schema |
| Detect | Diff review, eval failures, incident signals | Sole production authority |
| Propose | ADRs with rejected alternatives | Architecture-by-chat with no gate |
Agent roles (when to escalate beyond a prompt)
| Need | Agent | Notes |
|---|---|---|
| Multi-file plan | Planner pattern agent | No application code |
| Implement plan | Coder | Path-bounded |
| Review PR | Reviewer pattern | Human merges |
| Org / tenant AI | Security · Enterprise pattern | SoA first |
| SEV | Incident response | IC required |
Tradeoffs
A stage map slows “just ask the chat.” It prevents silent scope expansion and unverifiable AI output. Teams that skip the map recreate private dialects and lose auditability.
Anti-patterns
- Jumping to Coding before Story kickoff + plan approval
- Using MCP write tools as a substitute for Release / Hotfix patterns
- Treating evals as optional for user-visible model behavior
- Claiming AI SDLC compliance because prompts exist in a wiki
Enterprise considerations
- Stages 9 (plan), Security, and Release retain named human sign-off in regulated contexts.
- Evidence artifacts (plan, review, eval report) feed SoA / portal — prompts alone are not evidence.
- Data class constrains which MCP servers may enable at each stage.
Checklist
- Current stage identified
- Primary prompt opened from this table
- Skill activated with a concrete artifact
- Pattern used if change is consequential
- Human gate named before irreversible effects
- MCP still empty or allowlisted
Related
Changelog
- 1.0.0 (2026-07-29): Initial stage → tooling map with leverage rules.
Version: AIES v1.0.0✏️ Edit this page on GitHub