The latest articles on DEV Community by Marat Kee (@marat_kiniabulatov_8432bd). https://dev.to/marat_kiniabulatov_8432bd https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3843608%2Ff51513ae-ff97-4bc1-8bda-e1d6257d0834.jpg https://dev.to/marat_kiniabulatov_8432bd en Marat Kee Wed, 01 Apr 2026 11:07:50 +0000 https://dev.to/marat_kiniabulatov_8432bd/how-ai-is-shrinking-the-sdlc-in-greenfield-brownfield-regulated-industries-542m https://dev.to/marat_kiniabulatov_8432bd/how-ai-is-shrinking-the-sdlc-in-greenfield-brownfield-regulated-industries-542m <h1> How AI is Shrinking the SDLC </h1> <p><em>I work with experimental AI-first teams, exploring how agentic engineering impacts Lead Time. Here's what I'm seeing.</em></p> <p>And unlike some people say, I think that SDLC is not killed by agents. I think it compresses into something more lightweight.</p> <p>One person with AI can generate what used to require a team. The bottleneck shifts from writing code to validating it.</p> <p>But this isn't uniform across all contexts. Greenfield, brownfield, and regulated environments each compress differently.</p> <h2> Scenario 1: Greenfield / MVP / Internal Tools </h2> <p><strong>Context:</strong> New project, no users, low error cost, speed is critical.</p> <p><strong>What changes:</strong></p> <ul> <li> <strong>Tiered Code Review:</strong> security-critical code (auth, crypto) — 100% human review; everything else — automated checks + spot-check</li> <li>Observability as primary safety net (canary releases, auto-rollback)</li> <li>Iterations are now significantly faster, to the point where customer gets updates during the demo</li> </ul> <p><a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fov5nikmoskt9su805eks.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fov5nikmoskt9su805eks.png" alt="How SDLC looks for Greenfield Project" width="800" height="210"></a></p> <p><em>Important: even in greenfield, AI code contains <a href="https://www.coderabbit.ai/blog/state-of-ai-vs-human-code-generation-report" rel="noopener noreferrer">1.7x more issues</a>. Skipping review entirely is risky.</em></p> <p><strong>How to ensure we didn't make it worse:</strong></p> <ul> <li>Lead Time ≤ 1 day</li> <li>Deployment Frequency &gt; 1/day</li> <li>Change Failure Rate within DORA "Good" threshold (0-15%)</li> </ul> <h2> Scenario 2: Brownfield / Existing Product </h2> <p><strong>Context:</strong> Real users, established reputation, existing technical debt. Errors cost money.</p> <p><strong>What changes:</strong></p> <p>We need a <strong>tiered approach by risk</strong>:</p> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Code Type</th> <th>Human Review</th> <th>Examples</th> </tr> </thead> <tbody> <tr> <td>Security-critical</td> <td> <strong>100%</strong> senior review</td> <td>Auth, payments, PII, crypto</td> </tr> <tr> <td>Business logic</td> <td> <strong>30-40%</strong> peer review</td> <td>Features, API, data flows</td> </tr> <tr> <td>Utility</td> <td> <strong>Spot-check</strong> + automated</td> <td>Tests, docs, configs</td> </tr> </tbody> </table></div> <p>Found interesting stats: Per <a href="https://linearb.io/dev-interrupted/podcast/linearb-2026-benchmarks-ai-pr-merge-rate" rel="noopener noreferrer">LinearB 2026 Benchmarks</a>, AI PRs merge at 32.7% vs 84.5% for human code — most require rework. Per my experience, we accept only 18% of 100% ai written PRs.</p> <p><a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fu6tpogs7g69h2bb46433.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fu6tpogs7g69h2bb46433.png" alt="AI-native SDLC for Brownfield Project" width="800" height="179"></a></p> <p><strong>How to ensure we didn't make it worse:</strong></p> <ul> <li>Code Review Time doesn't grow (despite more PRs)</li> <li>Defect Rate stable or declining</li> <li>SLA/SLO maintained</li> </ul> <h2> Scenario 3: Regulated Industries (Fintech, Healthcare, Insurance) </h2> <p><strong>Context:</strong> Compliance requires human accountability. Audit trail is mandatory.</p> <p><strong>What changes:</strong></p> <ul> <li> <strong>100% audit trail</strong> for all AI-generated code: <a href="https://blog.pcisecuritystandards.org/ai-principles-securing-the-use-of-ai-in-payment-environments" rel="noopener noreferrer">who requested, what was generated, who approved</a> </li> <li>AI accelerates stages, but <strong>humans make decisions</strong> — this is a regulatory requirement (FDA, PCI-DSS, HIPAA)</li> <li>Stages can merge, but the artefacts are still reqiured for audit</li> </ul> <p><a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fvuhz0q95etdh8k6lo4mi.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fvuhz0q95etdh8k6lo4mi.png" alt="SDLC with AI for regulated projects" width="800" height="138"></a></p> <p><strong>How to ensure we didn't make it worse:</strong></p> <ul> <li>Change Failure Rate doesn't increase</li> <li>Compliance review time gradually decreases</li> <li>Audit trail complete and verifiable</li> </ul> <h2> The Bottom Line </h2> <p>There's no universal "new SDLC" with only agents and zero humans. Reality is a spectrum depending on project context.</p> <p>Besides the context, team and its culture dramatically influence whether AI makes it better or worse. It accelerates good practices and bad practices equally. Get your quality gate together and embrace the result.</p> ai programming productivity discuss