The AI-Fluent SDLC.
Coding is 6% of your delivery timeline. AI fluency is
using AI to compress the other 94%, without losing
trust in what ships.
Already using AI in your engineering pipeline? Take the five-minute Verdict instead.
19%
Experienced developers using AI were measurably slower
24%
Expected a speedup on real tasks
Contents.
A paper on moving the whole delivery cycle faster,
without losing trust in
what ships. Seven sections, then the path to install it.
Adoption is not fluency
Al concentrates on the 6% that is coding; the cycle is set by the 94%.
The fluency stack
Culture up through outcomes:
DORA's chain, with conduct added for the AI era.
The capability layer
Culture first, then four dimensions you can build and measure.
Conduct
Standards, regulations, and data boundaries, held while AI generates.
Engineering outcomes
Cycle time, stability, and quality: the evidence fluency leaves behind.
Reading your fluency
Two axes decide where you stand: earned trust, and flow across the cycle.
Why the usual moves don't close the gap
Tooling, upskilling, ad-hoc governance, scanners: each real, each incomplete.
Who this is for
CTOs and VPs of Engineering at regulated and health-tech software organizations. A field reading built
on public research plus our work with regulated teams, not a controlled benchmark. Lifecycle figures
are our analysis of one enterprise health-tech client’s delivery pipeline.
The Offer.
For Anthara
The conduct layer productized, enforced inside your own security boundary.
[CHAPTER 01/07]
Adoption
is not fluency
AI lands almost entirely on the 6% of the timeline that is coding. The cycle is set by the 94% the budget never touches.
- The 6% problem
- Usage up, outcomes flat
- Capability and conduct
At one enterprise health-tech client, the active coding stage ran 4.68 days inside an 11.7-week delivery cycle, about 6% of the calendar. AI has been aimed almost entirely
at that 6%. The other 94%, intake, estimation, handoffs, code review, QA, and
deployment, is where the weeks actually go, and most of it is still manual.
The money follows the same pattern. The AI budget, the seat licenses and the model bills,
lands almost entirely on the coding stage, those same 4.68 days. A team can put its whole
AI investment into that window and the 11.7-week cycle barely moves, because the cycle is
set by the 94% the budget never touches.
Almost every team now uses AI; almost none can say whether it’s making them better. About 90% of technology professionals now use AI day to day,² yet a 25% rise in AI adoption is associated with a 1.5% drop in delivery throughput and a 7.2% drop in stability. Usage went up; outcomes didn’t follow.
Almost every team now uses AI; almost none can say whether it’s making them better. About 90% of technology professionals now use AI day to day,² yet a 25% rise in AI adoption is associated with a 1.5% drop in delivery throughput and a 7.2% drop in stability. Usage went up; outcomes didn’t follow.
AI fluency actually means moving the whole delivery cycle faster without losing trust in
what ships. That’s both halves at once: compressing the 94% that isn’t coding, and being
able to point to why the output is safe. Adoption gives you neither for free.
To track adoption, most teams look at two areas: how much AI is used, and what the ticketing system says at the end. Neither shows where the weeks actually go, stage by stage, or whether code that ships faster is code you can stand behind. Both depend on something underneath: how well your people can judge what AI produces, and how tightly your rules hold while it does.
To track adoption, most teams look at two areas: how much AI is used, and what the ticketing system says at the end. Neither shows where the weeks actually go, stage by stage, or whether code that ships faster is code you can stand behind. Both depend on something underneath: how well your people can judge what AI produces, and how tightly your rules hold while it does.
A note on the numbers. The lifecycle figures are our own analysis of an enterprise health-tech client’s delivery
pipeline. The rest is a field reading built on public research plus our work with regulated teams, not a
controlled benchmark
What actually turns adoption into outcome is capability and conduct. Capability lets your
team push AI across more of the lifecycle; conduct lets them do it without the cycle blowing
up in review or audit. Both can be built, and both can be measured.
[CHAPTER 02/07]
The fluency
stack
Built from the bottom up, and the order matters. Culture, capability, conduct, then the outcomes leaders watch.
- The 6% problem
- Usage up, outcomes flat
- Capability and conduct
AI fluency is built from the bottom up, and the order matters. It starts with culture, runs through the capabilities and skills your people build, and how they conduct their AI agents. It finally shows up in the delivery and business outcomes leaders watch.
This is deliberately close to DORA’s own research model. Capabilities drive software
delivery performance, which drives organizational outcomes. For the AI era, we added one
layer, conduct, that DORA implies but doesn’t name. It includes the rules held while AI
generates code.
Business outcomes, value delivered, financial return, resilience, client happiness, sit at the
base of the stack. This brief deliberately stops one layer above, at the engineering
evidence, because that is where fluency can be read directly; the business layer is where it
cashes out
You build the capability and conduct layers. The outcomes beneath follow; they aren’t a
lever you pull directly. Capability is what your people can do with AI across the whole
lifecycle, well beyond the coding stage. Conduct is what your systems hold your people and
your agents to, while they do it
The real diagnostic is whether perceived safety matches actual safety: what the team
believes its AI produced, versus what the code actually does. When the two drift apart,
fluency is broken. Section 6 shows how to read where you stand.
Adoption depth is the journey; ungoverned depth is the trap.
Depth isn’t how often your team opens an AI tool, or how many tokens they’re using. It’s
how much of a single unit of work AI can carry on its own. The floor has already risen,
prompting to code is table stakes now, so the real question is how much further you can go
without losing control. These are the five levels we use in our fluency assessment:
The jump from level 3 to level 4 is the one that matters. That’s where AI stops working inside the coding stage and starts reaching into the 94%,
The jump from level 3 to level 4 is the one that matters. That’s where AI stops working inside the coding stage and starts reaching into the 94%,
pulling from the ticket, settling acceptance criteria, and moving work toward deployment.
Most teams stall before that jump. The higher levels are available; what’s missing is the ability to review and govern fast enough to trust an agent that far. Coding-agent adoption still sits between 15.85% and 22.60% across 129,134 projects, 3 even as about 80% of new developers reach for Copilot in their first week. 4
Most teams stall before that jump. The higher levels are available; what’s missing is the ability to review and govern fast enough to trust an agent that far. Coding-agent adoption still sits between 15.85% and 22.60% across 129,134 projects, 3 even as about 80% of new developers reach for Copilot in their first week. 4
[SAPAN’S TAKE]
Ungoverned depth is a tax every team eventually pays. Reach level 4
or 5 without people who can vet the output and rules that hold it in
check, and each step up adds risk faster than it adds speed.
[CHAPTER 03/07]
The capability
layer.
The part of fluency you can invest in directly. Each dimension is measurable today and moves a delivery metric months later.
- Culture
- Learning
- Skill & judgement
- Business fluency
- Documentation
This is the part of fluency you can invest in directly. Each area in this layer is something
you can measure today, that moves a delivery metric you care about months later.
Each is what an enablement engagement builds. And even these rest on one thing
that has to come first: culture.
Foundation: culture decides whether any capability takes root.
Culture is the soil the other four grow in. When AI usage is mandated by upper
management, teams won’t admit the AI is wrong or share what they learned the hard way, if
it isn’t safe to do so. DORA has measured this for a decade as generative (Westrum)
culture, and it remains the strongest predictor of whether any other capability converts into
outcomes.
The signal the whole stack depends on is whether engineers can hold each other accountable for what their AI produces. You cannot push sloppy code that raises the team’s review burden, and you cannot let your craft slide because AI wrote the code. Culture is being able to call that out. Measure psychological safety and learning-culture scores.
The signal the whole stack depends on is whether engineers can hold each other accountable for what their AI produces. You cannot push sloppy code that raises the team’s review burden, and you cannot let your craft slide because AI wrote the code. Culture is being able to call that out. Measure psychological safety and learning-culture scores.
[SAPAN’S TAKE]
If it isn’t safe to call out sloppy AI-generated code,
your review process is theater, and your stability numbers will tell on you.
your review process is theater, and your stability numbers will tell on you.
3.1 Learning and continuous capability
This is about how much your team collectively knows and whether you keep growing it.
People who can name the patterns and architectures they work in can direct and check
more of what the AI produces; narrow specialists can only vouch for their own corner.
Learning cadence, generalist ratio, and slack-time usage predict lead time and change
failure rate: teams that keep learning catch AI’s mistakes before they ship, and generalists
keep work moving instead of queuing behind the one specialist who knows.
Tools alone won’t do it. Leaders have to supply the conditions:
Planned slack time: protected hours for hackathons, learning sessions, and trainings,
counted as real capacity on the plan.
Continuous learning carried as an organizational responsibility, with a real budget and
cadence behind it
A hiring process updated for AI-centric skills, such as whether a candidate can read and
critique a large AI-generated plan, which now matters as much as writing code from
scratch.
Maintain senior-to-junior ratios of 3:1 with active pairing. Teams that protect pairing time
on AI-generated code keep their junior pipeline.
[SAPAN’S TAKE]
Apprenticeship matters more in the AI era. AI is doing the work
juniors used to learn from, so you have to build new learning loops
on purpose, or you’ll have no senior engineers in five years.
3.2 Skill and judgement.
When the capabilities around them are in place, individual engineers develop a recognizable
set of skills, and these are what a modern hiring process should test for now.
Tools alone won’t do it. Leaders have to supply the conditions:
Reading and judging AI output: evaluating large AI-generated plans, diffs, and code for correctness and fit. This is fast becoming the core engineering skill, and what the hiring process should test for.
Spec and intent authoring: telling AI what to build clearly enough to get the right result: specifications, constraints, and acceptance criteria. This is spec-driven development,
the leap past prompt-in, code-out.
Architecture and systems judgment:recognizing good structure when you see it and
steering AI toward maintainable design instead of plausible mess.
Generalist breadth: a wide surface area across the stack and the SDLC, so one person
can direct AI across more of the work and connect the parts.
Craft mindset: caring enough to keep the bar high for AI-generated code, so the quality
of the codebase doesn’t degrade over time.
Together these are what let a team take AI past the coding stage and into requirements,
review, and QA without losing the thread, which is where the 94% actually compresses
3.3 Business fluency.
As AI absorbs the purely technical work, the edge that’s left is the knowledge AI can’t pull
from the codebase or a prompt: how the business actually makes money, how this
organization actually works, and the rules of the domain it operates in. AI can write the
code. It can’t tell you which feature matters to the business this quarter, which internal
system will quietly break if you touch it, or where the regulatory and compliance landmines
sit. That judgment pays off earliest in the cycle, in scoping and estimation, long before code
is written, and it’s the part least substitutable by a model.
66% of developers cite “AI solutions that are almost right, but not quite” as their top
frustration; 75% would still ask another person when they don’t trust an AI answer.
“Almost right” is a judgment about your business and domain, the kind a model can’t
make for you.
88% of organizations now use AI in at least one business function,6
yet by one widely
cited analysis roughly 95% of enterprise generative-AI pilots show no measurable
financial return.
What’s missing is rarely the model; it’s the distance between the team
and the problem worth solving.
Decisions grounded in how the business and the system actually work, beyond the code
itself, predict rework rate and value delivered. Teams with that grounding build the right
thing the first time, which is the cheapest cycle time there is.
[SAPAN’S TAKE]
AI commoditizes the tech; the edge is what lives outside the
codebase, in your business, your systems, and your domain.
3.4 Knowledge and documentation systems.
Capability lives in more than people’s heads. It lives in the systems that capture and retrieve
what the organization knows: internal documentation and decision records that both
humans and coding agents can pull from. It is also what bridges the handoff and
onboarding gaps that sit inside the 94%.
DORA identified internal documentation quality as a force multiplier: the same AI
investment produces materially better outcomes where documentation is strong.
Documentation quality and retrievability predict lower lead time, time-to-restore (MTTR),
and onboarding speed, and they cut rework. Teams recover and ramp faster when
knowledge is written down and findable, by people and by coding agents.
In the field: across the codebases we’ve reviewed, the teams whose agents behaved best shared one trait, current and written-down context. Tooling budget didn’t predict it.
The prerequisite underneath:
an agent-ready codebase.
Modernization is now an AI prerequisite. Coding agents can only go as deep as your
codebase lets them. A legacy, undocumented, tightly coupled codebase keeps a team stuck
below level 4 no matter how good the tools are. Getting a codebase agent-ready, through
documentation, decoupling, and test coverage, is a precondition for fluency, and a subject
big enough for its own companion paper. In the stack, it sits where culture does, underneath
the capability layer as a foundation, not another dimension.
[SAPAN’S TAKE]
What’s good for your engineers is good for your agents. Clear
documentation and clean code help both; the messy kind drags both
down. AI just makes you find out faster which one you’ve built.
Capability, codified:
the bridge to the offer.
In the AI era, capability doesn’t stay in people’s heads. Its durable form is written down and
made executable: the practices, patterns, and domain rules your best engineers carry
become reusable skills, commands, hooks, and shared memory that every agent runs by default. That’s how craft scales when your pair is a model, you encode it once and every
session inherits it, instead of re-teaching it engineer by engineer. It’s also the bridge to the
offer at the end of this paper.
[SAPAN’S TAKE]
Codifying craft is how a team’s best practices stop being tribal
knowledge and become the default
[CHAPTER 04/07]
Conduct.
The enforcement half of fluency: standards, regulations, and data boundaries, held while AI generates rather than checked after.
- Compliance & audit posture
- Where the audit lands first
conduct is the enforcement half of fluency: your standards, the regulations, and the
data boundaries, held while AI generates rather than checked after. Capability
decides how far your team can push AI; conduct decides whether what comes back
can be trusted. In regulated software, it is where the audit lands first.
This is deliberately close to DORA’s own research model. Capabilities drive software
delivery performance, which drives organizational outcomes. For the AI era, we added one
layer, conduct, that DORA implies but doesn’t name. It includes the rules held while AI
generates code.
Compliance and audit posture: AI moves PHI into places that matter for audits.
- HHS OCR brought 16 HIPAA enforcement actions in 2024 (about $9.4M in penalties), and in late 2024 proposed the first major update to the HIPAA Security Rule in over 20 years (published January 2025). The proposed rule tightens encryption, risk-analysis, and resilience requirements for every system that handles ePHI, which would bring AI tools squarely in scope.
- PHI flowing into vendor LLMs without redaction is a real observed risk; the proposed rule would put all AI-driven paths that touch PHI in scope for audits.
[SAPAN’S TAKE]
Conduct has to live at the point of generation, where the code gets
written, long before any quarterly audit. The proposed rule will force
this regardless; the only question is whether you do it before OCR
shows up or after
[CHAPTER 05/07]
Engineering
outcomes.
The evidence fluency leaves behind. On their own, the lagging numbers that fooled everyone in Section 1.
- Cycle time & stability
- Quality & technical debt
These are the evidence fluency leaves behind. Measured well, they show whether AI is
making the cycle both faster and safer. On their own, they’re the lagging numbers
that fooled everyone in Section 1.
Cycle time and stability: did the whole cycle get faster, or only the typing?
AI makes the coding stage quicker. Whether that shows up in the 11.7-week cycle depends
on what happens to review, QA, and deployment, and whether change-failure rate holds
while it speeds up.
AI usage rose 65%, but median PR throughput rose just under 8% across 400+
companies, 9
far below the 3-10x vendor claims, because the coding stage was never the
bottleneck.
AI usage rose 65%, but median PR throughput rose just under 8% across 400+
companies, 9
far below the 3-10x vendor claims, because the coding stage was never the
bottleneck.
AI usage rose 65%, but median PR throughput rose just under 8% across 400+
companies, 9
far below the 3-10x vendor claims, because the coding stage was never the
bottleneck.
AI usage rose 65%, but median PR throughput rose just under 8% across 400+
companies, 9
far below the 3-10x vendor claims, because the coding stage was never the
bottleneck.
[SAPAN’S TAKE]
The cycle time you feel is end to end. Doubling the speed of 6% of the
timeline changes almost nothing; the real gains come from cutting
wait and handoffs across the other 94%.
Compliance and audit posture: AI moves PHI into places that matter for audits.
- AI-generated PRs averaged 10.83 issues per PR versus 6.45 for human-generated PRs, across 470 PRs.
- Modern static analysis reports a 3.2% false-positive rate across 137 million reviewed issues. The lesson holds regardless of the exact threshold: as false positives climb, developers stop trusting the tool's findings.
[SAPAN’S TAKE]
A vanilla code review isn’t enough anymore. Decide what actually
matters to you and run a fleet of reviewers, each tuned to something
you care about. And the cheapest quality you’ll ever add comes
earlier, when the team mobs on the spec and the plan before a line of
code exists.
[CHAPTER 06/07]
Reading your
fluency.
Two axes decide where you stand: how much you can trust what comes out, and how fast you move across the cycle.
- Earned trust
- Trust plus flow
Fluency has two axes: how fast you move across the cycle, and how much you can trust what comes out. Start with trust, because it’s the one teams misread.
First, what makes confidence worth trusting.
Confidence on its own means nothing; a team can feel sure and be wrong. What matters is
whether that confidence has matched reality, whether belief lines up with what the code
actually does. Plot the two against each other and the corner you want is clear: high
confidence that turns out to be right. That corner is earned trust.
The other corners are the failure modes. Sure but wrong is overconfidence, the automation bias trap, where AI output gets rubber-stamped and the bill arrives later. Right but doubted is under-trust, where capable people won’t lean on tools that actually work, and the speed sits idle.
The other corners are the failure modes. Sure but wrong is overconfidence, the automation bias trap, where AI output gets rubber-stamped and the bill arrives later. Right but doubted is under-trust, where capable people won’t lean on tools that actually work, and the speed sits idle.
Earned trust is confidence you can defend: belief that your AI-assisted work is sound
because the evidence says so, built on a track record of output that held up, problems
caught before they shipped, and stability that didn’t slip as you sped up. Capability and
Experienced developers using AI were measurably slower, 19% slower on real tasks, even as they expected a 24% speedup. That’s miscalibration in a single study: confidence ran well ahead of reality. The job is to bring the two back into line.
Experienced developers using AI were measurably slower, 19% slower on real tasks, even as they expected a 24% speedup. That’s miscalibration in a single study: confidence ran well ahead of reality. The job is to bring the two back into line.
Then, fluency is trust plus flow.
Earned trust is only one axis. A team can be correct and sure of it and still be slow, hand
reviewing every change, stuck and not realizing the productivity gains available to it. Cross
earned trust with flow, how much of the cycle you’ve actually compressed, and fluency falls
out as one corner.
Cross
earned trust with flow, how much of the cycle you’ve actually compressed, and fluency falls
out as one corner.
Fluency is the top-right: fast, on trust you've earned.
Adoption is not fluency
Al concentrates on the 6% that is coding; the cycle is set by the 94%.
The fluency stack
Culture up through outcomes:
DORA's chain, with conduct added for the AI era.
The fluency stack
Culture up through outcomes:
DORA's chain, with conduct added for the AI era.
The fluency stack
Culture up through outcomes:
DORA's chain, with conduct added for the AI era.
You reach the top-right by building capability and enforcing conduct as AI works across the
cycle. They’re the only levers that move flow and trust together, faster delivery you don’t
have to second-guess.
To find out which corner your team is in,
take the AI Readiness Assessment
[CHAPTER 07 / 07]
Why the usual moves don't close the gap.
Four fixes aimed at the wrong 6%, and what closes it.
- The four usual moves
- What finally closes it
This brief combines public research with field observations from regulated-software engineering
teams. The framework follows DORA’s capabilities, performance, outcomes model, extended with a
conduct layer for the AI era. Field observations are illustrative of patterns we see in engagements and
are labeled as such, not presented as a controlled study.
Delivery lifecycle timings (coding approx. 6% of the cycle, 4.68 days inside an approx. 11.7-week
cycle) are from our analysis of an enterprise health-tech client’s delivery pipeline. Anthara product
results (2-3x productivity, 2x fewer iterations, day-one onboarding) are the company’s own figures.
[SAPAN’S TAKE]
Conduct has to live at the point of generation, where the code gets
written, long before any quarterly audit. The proposed rule will force
this regardless; the only question is whether you do it before OCR
shows up or after
For Anthara.
The conduct layer productized: your team’s standards and your
industry’s rules, enforced the moment AI generates code, inside
your own security boundary.
Anthara is the conduct layer: your team’s standards and your industry’s rules, enforced
the moment AI generates code. It runs inside your network, VPC, or on-premises,
single-tenant. Code, prompts, and sensitive data never leave your security boundary.
Anthara sits between your engineers' coding tools (Claude Code, Cursor, Copilot, Codex) and your data and systems.
Five layers turn ungoverned adoption into governed automation:
The plugin.
We build a team-specific plugin into each tool's native format: spec-driven development, your standards, and a set of specialized agents and skills out of the box. It stands in for a separate upskilling program, so engineers ramp faster and generated code lands closer to standard without changing how they work.
Team-wide context.
Your architecture, standards, past decisions, gotchas, and working patterns served into every AI session over MCP, and built up as engineers work.
Compliance packs.
HIPAA, PCI-DSS, SOC 2, FDA SaMD, WCAG, ISO 27001, FedRAMP, and GLBA enforced as code is written, with state-level packs and your own custom rules alongside
Gateway
Every prompt and agent action passes through a gateway that redacts PHI and PII across 30+ attributes before anything leaves the boundary, and governs MCP tool calls at the query level (for example, block DELETE org-wide).
Governed agent automation.
This is where Anthara reaches past coding into the intake, ops, and deployment stages that make up the 94%. Create custom end-to-end workflows such as PR reviews, Jira-to-PR, RCAs, and CI/CD fixes that run autonomously or supervised, with a full audit trail.
This is capability and conduct in one platform. The plugin and context carry the capability
layer into every session; the packs, gateway, and governance enforce conduct in real time.
That’s how a team safely takes AI past the coding stage and into the review, QA, and
deployment work where the cycle time actually hides.
- AI-generated PRs averaged 10.83 issues per PR versus 6.45 for human-generated PRs, across 470 PRs.
- Modern static analysis reports a 3.2% false-positive rate across 137 million reviewed issues. The lesson holds regardless of the exact threshold: as false positives climb, developers stop trusting the tool's findings.
[NEXT STEP]
Start with a free Agent Experience Audit. A 48-hour scan of any repo, no integration
required. It surfaces where AI productivity is leaking, your codebase’s readiness for
agents, sensitive data flow, and security blind spots, and gives the CTO a depth-curve
narrative and the CISO a BAA-ready architecture view. Then book a walkthrough of the
platform.
[APPENDIX]
Methodology and sources.
This brief combines public research with field observations from regulated-software engineering
teams. The framework follows DORA’s capabilities, performance, outcomes model, extended with a
conduct layer for the AI era. Field observations are illustrative of patterns we see in engagements and
are labeled as such, not presented as a controlled study.
Delivery lifecycle timings (coding approx. 6% of the cycle, 4.68 days inside an approx. 11.7-week
cycle) are from our analysis of an enterprise health-tech client’s delivery pipeline. Anthara product
results (2-3x productivity, 2x fewer iterations, day-one onboarding) are the company’s own figures.
[REFERENCES]
01 DORA, 2025 State of AI-Assisted Software Development Report (Google Cloud).
02 DORA, Accelerate State of DevOps Report 2024 (throughput, stability, cluster distribution, and
documentation findings). dora.dev/research/2024
03 Robbes, Matricon, Degueule, Hora, and Zacchiroli, “Agentic Much? Adoption of Coding Agents on GitHub,”
arXiv:2601.18341, 2026.
04 GitHub, Octoverse 2025 (Copilot adoption among new developers and open-source maintainers).
05 Stack Overflow, 2025 Developer Survey (adoption, trust, and frustration figures).
06 McKinsey, The State of AI 2025 (88% adoption in at least one business function)
08 HHS OCR, HIPAA Security Rule NPRM fact sheet (December 2024 / January 2025); HIPAA Journal enforcement tracker
07 MIT NANDA, State of AI in Business 2025 (roughly 95% of enterprise generative-AI pilots show no
measurable return).
09 DX, AI and Engineering Velocity: A Longitudinal Analysis, 2026 (65% usage rise, 7.76% PR-throughput rise
across
400+ companies).
10 CodeRabbit, State of AI vs Human Code Generation, December 2025 (10.83 vs 6.45 issues per PR across
470 PRs)
11 Sonar, false-positive analysis, 2026 (3.2% across 137 million issues).
12 METR, Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity, July
2025.