Updated 17 October 2026 · Delivery and operations
Abstract. Continuous delivery in the agentic era is no longer a linear pipeline that transports human-authored code. Agents can plan, implement, test, review, deploy and operate. The control problem is therefore to convert fast probabilistic work into slow, trustworthy evidence. This article defines evidence-gated DevSecOps as a set of bounded loops whose transitions require signed, policy-checked artifacts.
Why velocity is an incomplete objective
DORA’s 2024 research found broad perceived benefits from AI adoption but also associations with reduced delivery performance and uncertain product effects (DORA, 2024). Its 2025 report describes AI as an amplifier of existing organizational strengths and weaknesses (DORA, 2025). Faster code generation can increase batch size, review load and instability unless verification and platform capability scale with it.
The evidence-gated delivery graph
| Transition | Required evidence | Automatic stop condition |
|---|---|---|
| Intent → change | Approved brief, risk class, acceptance tests | Ambiguous or contradictory requirement |
| Change → candidate | Diff, tests, static analysis, dependency inventory | Unexplained scope expansion |
| Candidate → artifact | Reproducible build, SBOM, signature, provenance | Non-reproducible or policy-failing build |
| Artifact → canary | Deployment plan, rollback, authorization | Missing recovery path |
| Canary → rollout | SLO comparison and anomaly bounds | Regression or uncertain telemetry |
| Rollout → learned state | Outcome, incidents, cost and review record | Incomplete evidence ledger |
Loop engineering formalizes triggered agent runs, machine-checkable stop conditions, persistent state, verifiers, budgets and escalation points (Lulla et al., 2026). The delivery graph supplies structure; the loop supplies bounded adaptation; the harness supplies isolation and authority.
Autonomous operations without autonomous risk
An operations agent may diagnose an incident, correlate traces, draft a mitigation and test it in a replica. Production action should depend on reversibility and blast radius. Safe automation starts with read-only investigation, progresses to reversible low-risk actions and retains human approval for destructive, financial, privacy or security-sensitive transitions.
Agentic cloud engineering research proposes evidence-gated progression and terminal failure under bounded recovery rather than unbounded “keep trying” behavior (Sakhinana & Runkana, 2026). This is the right reliability semantics: failure can be a correct outcome when constraints prevent safe completion.
Secure the agent supply chain
- Pin models, tools, MCP servers, plugins and skills to reviewed versions.
- Generate an inventory for code, containers, prompts, policies and agent dependencies.
- Sign artifacts and attach build provenance.
- Run untrusted repositories and retrieved content in isolated, network-constrained environments.
- Separate the identity that observes from the identity that changes production.
- Log policy decisions and approvals in an append-only evidence store.
NIST’s Generative AI Profile highlights risks including confabulation, data privacy, information integrity and value-chain integration (NIST, 2024). These risks apply directly to AI-authored software and tool-using delivery agents.
Platform engineering for agent consumers
Agents are new platform users. They need discoverable golden paths, typed tools, deterministic errors, ephemeral environments and fast verification. A poorly documented internal platform forces models to infer operational truth. A mature platform exposes safe intent-level actions—“create preview environment,” “run migration rehearsal,” “fetch SLO window”—rather than raw administrator shells.
Metrics for the loop era
Retain deployment frequency, lead time, change failure rate and recovery time, but add evidence completeness, autonomous retry count, human-review minutes, policy-denial rate, rollback rehearsal success, model/tool cost per accepted change and incident escape rate. Measure distributions by risk class. A single productivity number will hide whether gains came from genuine flow or deferred review debt.
Delivery principle. Continuous delivery becomes trustworthy when every automated transition is justified by evidence, bounded by policy and reversible by design. The purpose of the loop is not perpetual motion; it is verified convergence.
References
- DORA. (2024). Accelerate state of DevOps report 2024. Google Cloud. https://dora.dev/research/2024/dora-report/2024-dora-accelerate-state-of-devops-report.pdf
- DORA. (2025). State of AI-assisted software development 2025. Google Cloud. https://dora.dev/research/2025/dora-report/
- Lulla, J. L., Nersesyan, V., Mohsenimofidi, S., Treude, C., & Baltes, S. (2026). Loop engineering: Building blocks, adoption, and impact. arXiv. https://arxiv.org/abs/2608.21884
- National Institute of Standards and Technology. (2024). Artificial intelligence risk management framework: Generative artificial intelligence profile (NIST AI 600-1). https://doi.org/10.6028/NIST.AI.600-1
- Sakhinana, S. S., & Runkana, V. (2026). Towards agentic cloud engineering: Graph and loop engineering with a zero-trust agent harness. arXiv. https://arxiv.org/abs/2609.00050