Governing the Agentic SDLC in 2026

Six months ago we were worried about reviewing AI-generated code. Now the agent acts — and governance has had to move from the artifact to the action.

When I wrote about the “LLM Council” at the end of last year, the premise was simple: AI was generating code, designs, IaC, and API contracts faster than any human review board could absorb, and we needed a governance layer that ran at machine speed instead of meeting-cadence speed. That premise has held up. What hasn’t held up is the object the layer was built to govern.

In December, the unit of risk was an artifact — a block of generated code, a proposed design, a Terraform file — that a human still merged. Governance was a sophisticated gate in front of a human decision, and the human decision was the last line of defense. By the middle of 2026, that framing is already dated. The agent doesn’t hand you a diff and wait. It plans, calls tools, touches systems, and changes state across environments with delegated authority, often resolving five or six decisions before a human sees anything at all. The artifact is a byproduct now. The action is the thing, and the action has usually already happened by the time it surfaces.

That difference sounds incremental but it isn’t. Governing an artifact is governing a proposal — you can inspect it, reject it, and nothing in the world has changed…