The question
If AI coding agents are going to do real delivery work in an organisation that ships software to government, what has to be true so that nobody has to trust them? I designed the answer for a regulated Dutch public-sector software supplier: a pipeline that takes work from ticket to production with specialist agents in every phase, and with controls that do not depend on the agents behaving.
The principles
- Verification is the backbone. Every change to a model, a router or a prompt must pass its evaluation set before it ships. Acceptance tests are written by a separate verifier agent and frozen by hash before the run. There is a hard iteration cap, and “iterations to green” is a tracked metric.
- Humans keep the keys. Three human gates: definition of ready, review and merge, and production approval. No agent ever holds merge or production write rights.
- Autonomy only goes down. Agents get a graded autonomy level that policy can lower but never raise automatically.
- Least privilege, twice. An agent’s effective rights are the overlap of its own role and the sponsoring human’s rights, so it can never exceed that person. Tool access is default-deny and enforced both in the agent runtime and at the gateway, designed against the OWASP MCP Top 10.
- Data stays home. An egress guard blocks secrets and Dutch personal identifiers, build tooling works on synthetic data only, and model providers are gated by a zero-retention register.
- Evidence by default. A tamper-evident telemetry trail, kept for at least six months, aligned with Articles 12 and 19 of the EU AI Act.
What surprised me
The binding constraint was not tokens or model quality. It was human review capacity. Agents can only scale as fast as the people who verify their work, so the operating model, not the technology, sets the ceiling.
Status
Designed, approved by the management team and piloted in code at PinkRoccade Local Government. Described in general terms; the detailed material belongs to the organisation.