Distilled conclusions.
-
The Governance Paradox: Why the Most Regulated Industries Will Adopt AI-DLC First
Earlier this year, during an AI-DLC adoption assessment at a large financial institution in Latin America, something unexpected happened. The compliance team became the loudest champion of the methodology. Not the engineering leads, who were excited about the productivity gains. Not the CTO, who saw the strategic positioning. The compliance team, the people everyone assumed…
-
Who Owns AI Governance When Everyone Thinks Someone Else Does?
A few months ago, during a governance assessment at a mid-size financial services company, I asked a simple question: “Who owns AI governance here?” The CISO said the CTO owned it because AI is a technology decision. The CTO said the data team owned it because AI is fundamentally a data problem. The head of…
-
The Architecture Review Gap: Why AI-Accelerated Teams Need Them More
AI didn’t just increase delivery speed, it broke the cadence at which architecture is validated. Most organizations are still reviewing architecture at a pace designed for quarterly releases, while deploying multiple times per day. That structural mismatch, the distance between deployment velocity and architectural validation, is what I call the architecture review gap. It is…
-
Mob Construction: What Changes When AI Generates Code from a Real Specification
Two weeks after the Mob Elaboration session I described in my previous post, the same financial services team sat down for their first Mob Construction session. They had a validated specification: twelve user stories with acceptance criteria, a domain model with verification tiers, non-functional requirements with measurable thresholds, and a risk register that included the regulatory…
-
Mob Elaboration: What Happens When AI Runs the Requirements Room
The first time I facilitated a Mob Elaboration session, the Product Owner read the Intent aloud: a new customer onboarding flow for a financial services platform. Within four minutes, the AI had generated twelve user stories, acceptance criteria for each, a proposed domain model, and a decomposition into three independent units of work. A senior…
-
The Community Is Building AI-DLC Without Knowing It
A few weeks ago, a developer on Reddit posted about a workflow they had built for Claude Code (r/ClaudeAI, March 2026). They had split their AI-assisted development into three distinct agents: an Architect that defined the system design and constraints, a Builder that generated the code, and a Reviewer that evaluated the output against the…
-
Security as a Development Constraint, Not a Review Gate
A compromised npm maintainer account pushed malicious versions of Axios, one of the most widely used JavaScript libraries, to the registry. The attack, which hit last month, bypassed GitHub Actions entirely. The attacker published directly via the npm CLI with stolen credentials. A hidden dependency deployed a remote access trojan. For three hours, every npm install that…
-
Infrastructure as Code Is Not DevOps
Last month, March 2026, Iranian drone strikes hit AWS data centers in the Gulf. The me-south-1 region went offline, and developers scrambled. On Reddit, the stories split into two camps. One developer lost everything. They had Terraform templates. They had infrastructure defined in code. What they did not have was drift detection, cross-region reproducibility, tested…
-
The Measurement Problem: When Your Metrics Reward the Wrong Behavior
Last year, I sat in a quarterly business review where an engineering director presented what he called “the best quarter in the team’s history.” Velocity was up 42%. Pull requests per developer had nearly doubled. Sprint burndowns were textbook smooth. The slides were polished, the trend lines all pointed up, and the room was nodding…
-
Why Your Cloud Migration Succeeded and Your Cloud Operations Didn’t
A few years ago, a financial services company asked us to help them roll back a cloud migration. Not pause it. Not optimize it. Roll it back. This wasn’t a company that was new to the cloud. They had been running cloud-native workloads on AWS for years: new applications, innovation projects, critical business services built…
