Yet another event about artificial intelligence. That was likely the immediate reaction of many tech professionals upon seeing invitations to another seminar or conference on the topic. Weariness toward high-level conceptual discourse and distant promises is entirely understandable. The tech industry is saturated with presentations detailing what generative artificial intelligence might theoretically achieve in the coming years.
It was precisely to break away from that trend that we hosted our recent event at Numendo. Our goal was not to philosophize about the future, but to demonstrate a tangible reality. We set aside purely theoretical slide decks, opened our terminals, shared our screens, and showcased how we truly integrate artificial intelligence into our daily software engineering workflows.
This article provides a comprehensive breakdown of that session, centered on technical demonstrations and reflections on how our engineering practices are transforming. Below, we detail our augmented audit methodology, the orchestration of contextualized agents within development pipelines, AI-assisted production incident response, and critical protocols for security and data confidentiality.
A major technological shift demanding active adoption
To open the session, we had the privilege of welcoming Benoit Rigaut, whose keynote framed the essential questions surrounding artificial intelligence across software engineering. His remarks contextualized the scale of the ongoing revolution, which he directly compared to major industrial transformations of past centuries.
Artificial intelligence is not a mere incremental tooling upgrade; it represents a paradigm shift. According to Rigaut, current breakthroughs—impressive as they are—are merely the opening chapter of a much broader trajectory. Technological acceleration will continue exponentially, particularly in fields where experimentation faces few physical constraints: mathematics, project management, and software development are ideal proving grounds for algorithmic models.
The shifting core value of the software engineer
The takeaway for engineering teams is unambiguous: active experimentation must begin immediately. Panicking in the face of automation is a mistake, as is waiting for industry practices to stabilize into a final consensus. Innovation moves iteratively; resisting these shifts risks putting both individual engineers and entire organizations at a competitive disadvantage. Continuous learning, transparent knowledge sharing, and active engagement are the only effective responses.
Rigaut stressed a fundamental observation: artificial intelligence is not confined to automating code syntax generation. While routine syntax generation is rapidly commoditizing, the cognitive labor of the engineer is shifting up the stack toward higher-leverage responsibilities. Tomorrow’s software engineer—and already today’s—allocates more time to precise product definition, systems architecture, meticulous prompt and constraint engineering, and the systematic validation of machine-generated outputs.
Evolutionary horizons and strategic foresight
Looking forward, model capabilities will continue to advance rapidly. We can anticipate significant breakthroughs by 2026, particularly in how models autonomously resolve complex, directly submitted problems. By 2027, these algorithmic gains should materialize into concrete industrial applications in fields such as materials science and the life sciences.
Simultaneously, the structural decline in token and inference costs will unlock increasingly pervasive workflows. Interestingly, deploying the largest, most expensive foundation model is rarely necessary for every operational task. A disciplined practice of algorithmic frugality will become standard, routing each problem to the most cost-effective and task-appropriate model.
In this landscape, an organization’s competitive edge will not stem from generic access to foundational models, but from the proprietary execution framework engineered around autonomous agents. Internal tooling, architectural standards, role-based access control, automated governance loops, and, above all, internal context data will serve as core assets. For an artificial intelligence system to provide durable value within an organization, it must be grounded in reliable context: project histories, operational playbooks, and business logic, all maintained under strict authorization boundaries.
Reorganizing engineering workflows around contextualized agents
The technical demonstration delivered by our Lead Developer, Cedric, brought this architectural vision to life. At Numendo, we have moved past treating AI as an isolated conversational chatbot, restructuring it instead as an integrated agent operating directly inside our development environment. We treat the agent as a high-velocity collaborator whose output quality is strictly bounded by the fidelity of the context it receives, the team’s engineering standards, and the capabilities of its toolchain.
Centralized task routing and specialized working sessions
Our operational setup relies on specialized, domain-specific sessions built using Cloud Code. Each session operates under a distinct, bounded scope of responsibility:
- The Orchestrator Session (To-do): aggregates incoming requests across channels, monitors status, and suggests priority orderings.
- Project Sessions: dedicated work environments spun up for targeted engagements, such as application audits, feature development, or system documentation.
- The Wiki Session: dedicated exclusively to drafting, validating, and updating internal and external documentation.
- The Slack Integration Bot: serves as the asynchronous bridge between human team communications and the underlying multi-agent setup.
This operational layout substantially reduces cognitive overhead. The To-do session continuously tracks connected channels to propose structured workflows. However, final authority remains strictly human. The agent outlines priorities, but the engineer accepts, rejects, or adjusts them. If an urgent delivery arises—such as moving an audit readout forward by two days—the engineer updates the session, and the agent recalculates operational priorities accordingly.
Meanwhile, the Slack integration answers routine contextual queries using the internal knowledge base. Crucially, its operational privileges are tightly bounded. Our design enforces a strict separation between receiving information (which can be safely indexed) and receiving executable instructions (which require verified privilege escalation). If a team member requests a client follow-up in Slack, the agent registers the event, but cannot dispatch external communications without explicit human confirmation.
High-Fidelity documentation: the fuel of automation
One of our primary operational findings is that coordinating human-agent workflows demands a far higher standard of documentation than purely human workflows ever did.
To satisfy both human developers and autonomous agents, we organize documentation across three complementary tiers:
- Global organization wiki: maintained in Markdown and rendered to HTML. Accessible by both engineers and agents, it documents company-wide protocols, team structures, and shared infrastructure.
- Project-level documentation: covers application behavior, deployment pipelines, legacy constraints, and client-specific domain rules.
- Execution skills: highly structured, machine-optimized behavioral files explicitly authored to provide operational instructions to agents. A skill dictates precise output schemas, mandatory metadata (title, category, maintainer), and execution constraints.
This structure allows complex actions to proceed securely. For example, if an engineer notes in Slack that an SSL certificate renewal procedure is outdated, the report undergoes a human validation checkpoint. Once approved, the Wiki session takes over: it uses read-only commands to inspect the live environment, drafts the corrected documentation, and triggers a CI/CD pipeline to deploy the revision. Structured documentation is the baseline prerequisite for safe autonomy.
The augmented audit: reducing legacy code analysis time by 75%
The core of our technical presentation focused on our primary high-impact use case: auditing legacy enterprise applications. This is where AI-assisted engineering produces the most dramatic efficiency gains.
We detailed the precise methodology that enabled us to complete an in-depth application audit in 10 working days of effort, down from an estimated 40 days using traditional manual methodologies, while maintaining comparable architectural depth.
While the live event showcased this process on an illustrative application—”The Artisan Workshop”, an interactive booking platform—the approach directly reflects enterprise audits we conduct on high-volume production architectures, such as complex e-commerce platforms facing critical scalability constraints.
Crucially, those 10 days of effort do not mean an agent was left to run unassisted. That timeline represents total human-in-the-loop effort: upfront scoping, real-time agent supervision, qualitative analysis, and manual verification of all findings by a lead software architect.
Phase 1: Isolation, Redaction, and Scope Segmentation
Executing agents against an unfamiliar codebase requires disciplined preparation across four distinct steps:
- Codebase Freezing: the repository is locked to an exact reference commit. Every identified vulnerability, design flaw, or code smell is tied immutably to a specific revision history, preventing discrepancies caused by concurrent commits.
- Deterministic Secret Sanitization: before any code is processed by language models, automated scripts combined with established security tools such as GitLeaks inspect the codebase and its Git history. All API keys, database credentials, access tokens, and sensitive strings are identified, scrubbed, and replaced with safe tokens.
- Audit Matrix Configuration: we assemble a specialized audit matrix combining global standards (such as the OWASP Top 10) with architecture-specific rules (such as headless architecture best practices versus monolithic framework conventions).
- Automated Architectural Inventory: The agent segments the codebase into discrete, bounded components: core business engine, authentication services, payment gateways, session handling, cancellation pipelines, and third-party integrations.
The subsequent analysis does not attempt a naive, single-pass evaluation of the entire repository—an approach prone to severe hallucination and context degradation. Instead, we run specialized agents in parallel waves. In our demonstration, four discrete agents audited different architectural domains concurrently. This wave-based execution respects provider rate limits while enabling human auditors to inspect the output of wave one, refine context instructions, and deploy wave two with greater precision.
Combining deterministic linters with semantic agents
AI agents do not replace established static application security testing (SAST) tools or syntax linters; they address what deterministic tools systematically miss.
Our operational model divides labor cleanly:
- Standard linters and SAST tools: process syntax conformity, type checking, and known common vulnerabilities and exposures (CVEs).
- AI Agents: investigate business logic vulnerabilities, state-machine inconsistencies, cross-service transaction flows, and implicit domain constraints buried in legacy code.
- Deterministic post-processing: automated scripts filter out low-confidence outputs and recurring false positives before human review.
Each finding is output as a structured document. We enforce a zero-tolerance policy for unsubstantiated claims: an agent cannot flag an issue without citing exact source files and line numbers. Furthermore, if an agent evaluates an audit criteria item as “not applicable,” it must output a reasoned technical justification detailing why the codebase is exempt.
Every finding card aggregates:
- Business-level risk description
- Low-level technical implementation failure
- Affected dependencies and downstream services
- Audit matrix traceability
- Implicit domain rules extracted from source behavior
Mandatory human review and criticality matrices
Determining vulnerability severity is not delegated to the language model. Criticality assignments (P0 through P3) are strictly governed by an agreed-upon risk matrix. A P0 finding represents an immediately exploitable vulnerability, direct financial exposure, or a critical availability risk.
All P0 and P1 findings undergo mandatory manual verification by senior architects. This requires reading the raw source code and attempting reproduction in an isolated staging environment.
To further safeguard accuracy, we employ an adversarial agent protocol. A secondary agent, provisioned with alternative instructions and tasked with skeptical cross-examination, independently attempts to invalidate the primary agent’s findings.
This hybrid verification regularly recalibrates results in both directions. In our demonstration, an agent flagged a potential double-debit issue on a duplicate button click as a critical P1. Human review lowered it to P2 after discovering that the payment gateway’s downstream API implemented idempotent request-token deduplication. Conversely, minor findings often get escalated to P1 once an architect identifies that a seemingly low-risk logic flaw exposes a sensitive downstream system.
While no automated framework can guarantee the detection of every latent bug, combining systematic codebase inventorying with verifiable citations guarantees deterministic coverage over the audited scope.
Delivering long-term value beyond the audit report
Accelerating the analysis phase allows engineering teams to reallocate time toward generating high-value deliverables that ease future maintenance:
- Evidence-backed findings register: complete with reproducible proofs of concept.
- Extracted business logic documentation: formalized documentation of domain behavior that had been buried in undocumented legacy implementations.
- Architectural retro-documentation: up-to-date system dependency graphs and component schemas.
- Operational Agent Skills: project-specific guardrails and context files that can be fed into agents used by incoming developers to prevent regressions.
- Prioritized Technical Backlog: Sized and ordered by business ROI and risk exposure.
When a codebase proves too degraded to justify ongoing maintenance, extracting its core business rules enables leadership to make informed decisions about targeted rewrites, building modern services directly from verified requirements rather than deciphering defective legacy implementations.
Want to get the replay for free?
Assisted engineering and production incident response
Beyond static audits, our session illustrated how agent workflows enhance daily software maintenance and incident management. Cedric demonstrated an assisted feature implementation: updating access-control ownership within an internal tooling platform.
Given a structured functional specification, the agent proposed an implementation plan and immediately highlighted ambiguities in the initial requirements. The human developer resolved key architectural constraints, unblocked dependencies, and directed the agent to move forward.
The workflow followed strict Test-Driven Development (TDD). The agent wrote failing automated test cases before writing implementation code. Running the test suite provided automated feedback: test failures prompted the agent to self-correct its code until all assertions passed. Because the agent was constrained by the project’s local skills files, it reused existing design tokens and component libraries rather than introducing redundant third-party dependencies.
Resolving a live production outage
The most demanding scenario presented was the simulation of a critical production performance regression: an e-commerce checkout flow experiencing sudden latency spikes from a 420-millisecond baseline up to 7 seconds, triggering cascading HTTP 504 gateway timeouts.
The troubleshooting agent was deployed with strictly enforced read-only access to production metrics and logs, honoring the principle of least privilege. By evaluating application logs before and after a recent 2:00 PM deployment, the agent isolated the root cause in minutes.
The automated analysis identified:
- A 25x surge in database query volume.
- Up to 2,400 SQL queries generated by a single checkout basket containing 40 line items.
- A classic N+1 query loop introduced by a newly deployed promotional discount module that made unbatched metadata calls for every individual item.
The agent delivered a structured incident report cross-referencing server telemetry with specific Git commit diffs. By design, safety guardrails prevented the agent from applying changes directly to production. Armed with the agent’s diagnostic report, the human engineering team made the operational call to disable the promotional module via a feature flag, immediately restoring response times to 405 milliseconds.
With production stabilized, the engineer used the agent to construct a permanent hotfix, including automated regression tests and pre-production load test scripts. The pull request was reviewed and approved by a second human engineer, and a new CI smoke test was deployed to prevent performance regressions in future releases.
Confidentiality, access governance, and data security
Integrating generative artificial intelligence into enterprise engineering demands strict information security controls. During the event, we outlined the governance framework required before deploying agents across client codebases.
Client contracts must be systematically reviewed to define permissible tooling. Technical leaders must engage client security teams and CISOs directly, providing complete transparency regarding which assets (source code, schemas, issue trackers, or wireframes) interact with model endpoints.
Our security framework implements a defense-in-depth model across five discrete layers:
- Approved model routing: we run queries exclusively through client-approved vendors via managed endpoints or through routing gateways like OpenRouter. For highly sensitive intellectual property, workloads run on-premises using self-hosted, air-gapped open-source models to ensure zero external data egress.
- Aggressive data sanitization: automated pipelines scrub and mask personally identifiable information (PII) to comply with data privacy regulations like GDPR.
- Inherited filesystem permissions: agents operate under POSIX-style least-privilege principles, preventing access to files or directories restricted from the executing engineer.
- Context isolation: memory spaces, documentation, and skill definitions are strictly sandboxed per client and project, preventing cross-tenant context leaks.
- Deterministic pre-execution classifiers: local, lightweight pattern classifiers evaluate files and prompt contexts before transmission to any language model. If an unauthorized secret, credential, or sensitive entity is detected, execution hooks abort the operation instantly.
Economics, verification, and team evolution
Adopting AI-augmented workflows introduces organizational and economic considerations that engineering leadership must navigate intentionally.
First, teams must accept that large language models are non-deterministic. Running the same code analysis across two distinct agents may yield differences in language or analytical emphasis. Such variance does not necessarily indicate inaccurate output; rather, it often exposes ambiguities in the project’s instructions or undocumented domain edge cases. This is why our framework relies on strict verification: mandatory citations, iterative analytical passes, and mandatory human sign-off on critical findings.
Financially, the return on investment is clear. In our 40-day-to-10-day audit benchmark, total token consumption accounted for approximately $2,000 to $3,000 in model API expenses. Compared to the loaded labor cost of 30 days of senior engineering time, the cost-benefit ratio is overwhelmingly positive. Nevertheless, monitoring inference costs and optimizing context efficiency (evaluating token cost per unit of work) are rapidly becoming essential management competencies for technical leads. Leveraging smaller, fine-tuned open-source models represents a major lever for controlling operational expenses at scale.
Finally, we addressed the impact on junior engineers and skill acquisition. If autonomous systems generate base scaffolding and resolve syntax errors, how do early-career developers build foundational intuition? At Numendo, we believe engineering training must pivot. We focus on training junior developers in system-level architecture, business domain modeling, rigorous verification, and adversarial analysis. Relying blindly on automated tooling risks degrading deep systems understanding over time. Engineering organizations must consciously cultivate specialists capable of operating at the lowest layers of the stack whenever automated abstractions break down.
Beyond the terminal: enterprise operational workflows
To conclude our session, we highlighted how these agent principles extend beyond core software development:
- Talent acquisition and operations: automatically restructuring consultant profiles into standardized internal formats with 95% initial accuracy, incorporating an automated privacy pipeline that strips PII before processing and reattaches it afterward.
- Pre-sales and strategic communications: drafting custom technical proposals, client-facing system overviews, and interactive onboarding documentation within brand guidelines. In fact, the interactive slide framework used throughout our meetup was generated using AI, built directly on a React and Node foundation.
Artificial intelligence is neither a replacement for engineering expertise nor a passing trend. When deployed within a disciplined framework—anchored by structured context, strict governance, mandatory human review, and hardened technical safeguards—it is an unprecedented force multiplier for technical teams.
The role of the engineer is evolving: moving away from mechanical execution toward architecture, orchestration, critical review, and ownership of final outcomes. That is an exciting, high-leverage shift, and one we are committed to advancing every day.
Request access to the session recording
If you would like to explore these multi-agent workflows in greater detail, or observe the live demonstrations of the application audit and production incident resolution, the full recording of our session is available upon request.
To maintain confidentiality and foster direct dialogue with peers across the engineering community, access is shared on an individual basis. We welcome the opportunity to connect, exchange notes on production implementations, and discuss the specific engineering challenges your organization faces.
