The Regulated AI-first SDLC: Intent in → Evidence Out

Most institutions are somewhere on the assistant curve: licences bought, adoption dashboards green. JPMorgan's LLM Suite reaches more than 230,000 employees, and the bank reports engineer efficiency gains of 10 to 20 percent. That is the floor, not the model. An assistant accelerates the typing inside an unchanged process; the process still assumes every artefact was hand-made by the person who signed it.

AI-first delivery inverts the assumption. The default author of code, tests, configuration, documentation and evidence is a machine, and the humans hold the two jobs machines cannot hold for them: deciding what should exist and what must never happen, and owning the approval. Google's DORA research programme put numbers on why the distinction matters. With AI adoption at 90 percent, its 2025 report found AI acts as an amplifier of the organisation it lands in: teams with strong automated testing, version control discipline and fast feedback loops convert AI speed into throughput, while teams without them convert it into downstream instability. The tooling is the same in both cases. The operating model is the difference.

Run the model across six stages: Intent, Design, Build, Verify, Deploy, Monitor. The pattern at every stage is identical. AI produces the artefact, a binding gate verifies it, and the gate emits evidence into the record as a by-product of passing. Nobody writes the audit pack afterwards, because the pipeline has been writing it all along.

A policy document is advisory the moment the author of the code is a model. If a rule matters, it has to live where the work happens: in the templates, the pipeline and the harness.

Two mechanisms carry most of the weight. Reference patterns are the institution's paved roads: the approved way to build an ingestion job, a model call, an agent with tool access, packaged as scaffolding with the controls already wired in. An agent that starts from the pattern inherits the controls; a team that leaves the pattern does so visibly and with sign-off. Policy as code turns the standards library into executable checks: data-handling rules, dependency rules, entitlement boundaries, all enforced in the pipeline where they cannot be skipped politely. This is also the direction of supervision. APRA's April 2026 letter to industry expects recognised control frameworks, control libraries and change control applied to AI implementations, with second-line and internal-audit functions technically equipped to assess probabilistic and agentic systems.

This is no longer theoretical in Australia. CommBank's Project Coral runs agents that identify technical debt, propose the fix and push it through CI/CD testing, with engineers approving every change before merge: the intent-constraints-approve model, in production, at an APRA-regulated major.

A gate that only checks functional correctness certifies the smallest slice of what a regulated institution is accountable for. The gates have to carry the full surface, and each item has a supervisory anchor, which means each item will eventually be somebody's question to you.

Scaled consumption is where AI-first delivery earns its keep and where it can go most wrong. Two rules cover most of it.

First, agents are identities, not features. An agent touching payment platforms, customer channels or data warehouses gets what any new joiner gets: its own credentials, least-privilege entitlements, rate limits and a revocation path. No shared super-user service accounts, no standing access to production data because it was convenient during development. The blast radius of a misbehaving agent is set on the day you provision it, not on the day it misbehaves.

Second, model providers are suppliers, with everything that word carries under CPS 230. APRA's review found entities heavily dependent on a single provider across multiple AI use cases, and few who had tested exit or substitution plans. If a critical operation depends on a model API, that provider belongs in your material-service-provider thinking: concentration assessed, contingency planned, substitution actually exercised rather than asserted. A model swap is a change like any other, which means it goes through the gates like any other.

Deployment is the midpoint of the lifecycle, not the end. Three run-side capabilities keep an AI-first estate supervisable.

Observability that speaks behaviour, beyond uptime. Production evals and baselines for what the system should be doing, so drift is detected by measurement rather than by a customer complaint. APRA's expectation of lifecycle ownership through to decommissioning lands here: someone owns the behaviour of every deployed model and agent, by name, for as long as it runs.

Self-healing with a tripwire. Known failure classes get automated remediation: retry, quarantine, roll back, re-route. The unknown ones trip a wire to a human, with the evidence of what happened already assembled. The loop that cannot close itself must never pretend it can.

Cost as a first-class signal. Token and compute spend per outcome is tracked like latency. Agentic systems can silently multiply their own consumption through retries and tool loops, so a cost regression is treated as a defect: detected at the gate, monitored in production, owned like any other budget.

Every one of these has already happened to someone, publicly. The pattern across all of them: the guardrail existed as an instruction, and instructions are not controls.

This briefing is not a thought experiment. LiquidNexus, ComplianceNexus and AssureNexus were built under exactly this operating model: intent and constraints set by a human, artefacts and evidence produced by agents inside a harness, binding verification before anything advances, and an audit trail that assembles itself. AssureNexus is that framework made product: the delivery lifecycle, gated and evidenced, with every agent decision provably intact. The fastest way to evaluate the model is to inspect a system built by it.