Canonical: https://uhl.cloud/en/resources/agentic-engineering-standards/
Language: en
Format: public page content, generated from HTML

# Agentic Engineering Standards

The discipline sheet for teams letting AI agents write code - the same rules we apply to our own repositories every day.

ChecklistUpdated 2026-10-27

[Download the PDF](https://uhl.cloud/assets/resources/agentic-engineering-standards-en.pdf?v=2f1acf63c816)

## Why discipline, not tools, is the hard part

An agent that writes code is a fast junior with infinite stamina and no memory of consequences. It will produce plausible diffs at 3am and, unsupervised, plausible damage too. The fix is not a better model - it is the same engineering discipline good teams already have, enforced where the agent cannot bypass it: in branches, reviews, CI and merge rules.

## The checklist we run against

- Agents work on feature branches only - direct commits to main are disabled by branch protection, not by convention

- Every agent change arrives as a merge request with a description a human wrote or reviewed - the 'why' is never generated silently

- CI must pass before merge and the merge button requires a human - pipeline green is evidence, not permission

- Diffs are reviewed like any contributor's: secrets, license headers, dependency additions and generated files get explicit attention

- Secrets never enter agent context - credentials live in the secret store; if a value reaches a transcript it is rotated as an incident

- Agents verify against the real system, not assumptions - a claim of 'deployed' or 'merged' is confirmed by reading actual state

- Lockfile and dependency updates are owned by the dependency bot (Renovate) - agents do not compete with it on the same branch

- Destructive operations need explicit human instruction - force-push, deletes and history rewrites are never inferable from context

- Generated artifacts are reproducible - a script in the repo rebuilds them, so the diff can be audited rather than trusted

- Post-merge state is verified - the applied revision in deployment matches the merged commit, not just a green pipeline

Every rule above is enforced by infrastructure - branch protection, required pipelines, secret stores - not by trusting the agent to remember it.

## What this buys you

Speed without audit debt. Our agents ship several merge requests a day under these rules, and the review load stays human-sized because the rules catch the failure modes early. A team that adopts the checklist keeps the velocity and loses the weekend incident. That is the entire trade - there is no version where the discipline is optional and the outcome is the same.

## Chat with UHL

Start a guided chat. The assistant asks a few questions and saves your enquiry for our team to review.

## Continue exploring

- [AI & automation](https://uhl.cloud/en/ai-automation/)

- [Software development](https://uhl.cloud/en/development/)

- [Security & responsible AI](https://uhl.cloud/en/security/)

## Let’s discuss your project.

[Talk to UHL](https://uhl.cloud/en/contact/)