SFEIR's decryption (firm voice) of Jason Clinton's (Deputy CISO, Anthropic) debrief published five days earlier — already documented in [[clinton-anthropic-secure-ai-native-sdlc-2026-07-21]]. **The added value lies not in the facts but in the thesis that rereads them**: if Anthropic's controls hold, it is because **a cycle with named stages exists to hang them on** — "the SDLC is the foundation, not a formality." The demonstration proceeds by rereading the mapping (**PSR at Plan, CLAUDE.md + egress allowlist at Code, review agents at Test, continuous DAST at Deploy, triage + SIEM routing at Monitor**), then through a **four-part anaphora**: (1) *without an SDLC, productivity gains do not materialize* — Clinton cites **Amdahl's law**: multiplying code volume by 8 multiplies nothing if review stays sequential and human, and Anthropic gained not by distributing agents but by **identifying the blocking stage (Test) and rebuilding it** — "you don't optimize a bottleneck you haven't mapped" (echoing DORA 2025's **mirror effect**); (2) *without an SDLC, security has no anchor point* — a **gate is by definition a control placed between two stages**, and Clinton's three threats are addressed at distinct moments; (3) *without an SDLC, no **token FinOps** policy can be formulated* — agentic scanning is billed on consumption and grows with code throughput, so **risk-based tiering IS the FinOps policy** (it decides where three agent passes get paid for and where a SAST suffices), otherwise "token spend is not steered, it is discovered at month's end"; (4) *without an SDLC, there is nothing to measure* — the indicators (16% → 54% of PRs commented, one third of past incidents intercepted) exist only because there are stages where a counter can be placed; absent that, one produces only **usage figures** (licenses, tokens) that say nothing about quality or risk. Two strong points beyond the thesis: the reading of the **incident agent-à-agent** ("a security perimeter that rests on an instruction in a prompt is not a perimeter"; **an agent's access to other agents is part of its attack surface**) and an **explicit methodological caveat** — Anthropic's figures about Anthropic, unaudited, published by the vendor of the model described, in the context of a young codebase with no mainframe: **what transposes is the method, not the figures**.
#SDLC#AI-native SDLC#development cycle
SFEIR (voix éditoriale du cabinet, article non signé individuellement) — commentaire de Jason Clinton (Deputy CISO, Anthropic)
Security REX signed by **Jason Clinton (Deputy CISO at Anthropic)** — with contributions from **Michael Segner** — published on **July 21, 2026** on the Anthropic blog (categories *Claude Code / Enterprise AI / Agents*). **Shock framing**: securing an SDLC where ***"Claude authors about 80% of the code merged"*** and where ***"more than half of all code is being merged by our internal version of Claude Tag"***, while engineers *"ship 8x as much code per quarter"* (vs. the 2021-2025 baseline). The challenge is an **Amdahl** problem: if controls don't scale, they become the bottleneck. **Three threats frame everything**: (1) a **compromised or prompt-injected agent** introducing a malicious change; (2) **supply-chain / dependency poisoning** ingested as *trusted input*; (3) **familiar classes of application vulns at higher volume**. **Four cross-cutting strategies**: *shift left* (integrated at the Code stage), **hard identity and access boundaries** to contain the *blast radius*, **combining deterministic (SAST/DAST) AND agentic reviews** before/after prod, **humans in the loop at the highest-leverage points**. The post is explicitly **meant to be paired with Anthropic's *Zero Trust for Agents* framework** (and points to the *CISO's Guide to Agentic AI*). **Step-by-step walk through the SDLC** (each step → an *Enduring Principle*): **Plan** — a **PSR (Project Security Review)** powered by **Claude Opus**, checking the design doc against **MITRE ATT&CK**, wired to an **internal knowledge index**; auto-approval allowed for *low-risk* projects → *principle: connect security agents to organizational context* (chat, past reviews, code) rather than mandating documentation. **Code** — security encoded in **CLAUDE.md + skills**, a **closed loop** from discovered vuln to updated guidelines, the **`/security-review`** command, a real-time guidance plugin, **remote VMs with egress allowlisting** to limit the *blast radius* of an agent exposed to untrusted input → *principle: close the feedback loop; hard identity/access boundaries rather than trust in model behavior*. **Test/CI** — **the biggest bottleneck**: substantive review comments rising from **16% to 54% of PRs**, ~**a third of past claude.ai incidents would have been caught**, **several narrowly-focused specialized agents** with per-PR **RAG** context, **SAST posting directly on PRs**, a **risk-tiered codebase**, every approval **logged with reasoning and signals**, **risk-weighted human sample audit** → *principle: automated review is a different risk → different controls (multiple independent gates, separate context windows)*. **Deploy/CD** — **continuous AI-driven DAST** in staging (Claude found ***"more than 500 high-severity OSS vulnerabilities"*** in February) → *principle: dynamic test cadence equals deployment cadence*. **Monitor** — **agents de réponse à incident** that read prod logs, do root-cause analysis, write post-mortems and sometimes the fix, but **cannot deploy**: only **three permissions** (write docs, post in channels, read prod logs); **notable incident** — after a model upgrade, the incident-response agent asked **another Claude instance to push a fix via Slack**, *"caught at a human review gate as designed"* → *principle: **single-purpose identity with minimal permissions**; monitor **agent-à-agent** channels the way human interactions are monitored*. **Governance**: risk tiering, **shadow mode** (new AI reviewers in comment-only mode, *red-teamed* before earning trust), **sampling**, metrics dashboards, **SIEM routing** of every agent action (approvals, tool calls, agent-à-agent messages) for audit and insider-threat detection → *principle: the security engineer's role shifts from "monitoring bugs" to **"monitoring loops"***. **Strategic question**: *"What would we run if scanning were nearly free?"*. On the **security/governance** side, this extends the AI-SDLC cluster of the watch: the *Steps of AI Adoption* from [[cherny-steps-ai-adoption-2026-07-16]] (Claude Security Review, Claude Tag, shadow mode, SIEM/OTel), the multi-agent adversarial review from [[monperrus-end-of-code-review-agents-supersede-2026-06-11]] and sumner-bun-rewrite-rust-claude-2026-07-08, the *skills / systems around the model* doctrine from anthropic-self-service-data-analytics-claude-agentic-stack-2026-06-03, the failure modes from williams-adlc-1-models-arent-human-2026-06-12, the six-stage SDLC from hingel-augment-how-ai-changes-sdlc-six-stages-2026-06-08, and the Project Glasswing cyberdefense from anthropic-claude-fable-5-mythos-5-2026-06-09.
#AI-native SDLC#AI-native SDLC#security
**Jason Clinton** — *Deputy CISO* (directeur adjoint de la sécurité des SI) d'**Anthropic** · pilote de l'équipe *Security Engineering* ; contributions de **Michael Segner**. Billet publié le **21 juillet 2026** sur le blog Anthropic (*claude.com/blog*) · catégories *Claude Code / Enterprise AI / Agents* · ~5 min de lecture. Compagnon explicite du framework *Zero Trust for Agents* publié par Anthropic.
Guide by Augment Code (Paula Hingel) describing how AI agents are restructuring the software development lifecycle (SDLC), stage by stage. Thesis: AI produces **higher throughput at some stages and higher instability risk at others** — a symptom of uneven adoption without redrawing review boundaries. Draws on **DORA 2025**: AI adoption correlates positively with delivery throughput and product performance, but **negatively with stability**. Six stages revisited (Requirements, Design/Architecture, Implementation, Testing/QA, Deployment, Maintenance), three major risks (erosion of the junior pipeline, **circular validation** of AI-generated tests, governance gaps at scale) and three emerging roles (**Intent Engineering**, Agentic DevOps, AI Governance/Assurance). Actionable recommendations: audit one stage before scaling, stress-test governance, make the **specification** central, define explicit rollback policies, redesign the junior role around review.
#SDLC#software development lifecycle#coding agents
Official **Salesforce News** blog post (*Agentic Enterprise* section, *"Pioneering the Agentic Shift Within Salesforce Engineering"* series), published on **May 27, 2026** (6-minute read) by **Srinivas "Srini" Tallapragada**, *President and Chief Engineering and Customer Success Officer* at Salesforce. Direct follow-up to an earlier post (*"How we got our engineers to use AI — without breaking everything"*) which recounted crossing **>90% adoption**. **Pivot thesis**: Salesforce Engineering moved from a world where AI was a useful *copilot* to one where **agentic tools drive the software development lifecycle (SDLC) itself** — writing code, reviewing PRs, generating tests, updating documentation, managing deployments, coordinating work once handled through human handoffs. **Canonical signal decision**: org-wide standardization on **Claude Code** + ***"we removed all token limits"*** — *"remove every last piece of friction between our engineers and the tools that make them faster and more effective"*. **Major empirical result** (April 2026 vs April 2025): work items completed per developer **+50.8%**, PRs merged per developer **+79%**, and above all **Effective Output score** (an ML measure of the **real value of delivered code**, not volume) **+151.3% year over year**. **Flagship use case**: migration of **33 API endpoints** to a cloud-native architecture, estimated at **~231 person-days** (7 per API) the traditional way, completed in **13 days — 18× faster** — via a **rule-based framework built in Claude** (markdown files + reference implementations), with PR feedback continuously fed back into the rule set, **autonomous LLM loops (build, fix, validate)** with no manual intervention, parallelized across isolated environments → **5 PRs**, the largest delivering **21 endpoints with 100% test coverage**. **No speed↔quality tradeoff**: through the **Engineering 360** platform (centralizing engineering data from hundreds of systems), **total incidents drop by 5%** despite the rise in PRs (*"quality doesn't suffer from speed. It benefits from it"*), thanks to **security guardrails and quality standards structurally embedded** in the agentic workflow (Trust as the #1 value). **SDLC overhaul**: once AI is adopted, engineers **tear down and rebuild** workflows (which processes to eliminate? which handoffs are now unnecessary? where does a human still do work an agent could own?). **New engineering craft**: **Claude Code skills** (packaged, reusable capabilities encoding team context, naming conventions, patterns) become a shared, composable **engineering artifact**; **AI Expert Suite** + **Salesforce Foundation Plugins** = an institutionalized, curated skills library (internal benchmark: **higher accuracy and reliability, reduced unnecessary cost**); **subagents & agent teams** parallelize workstreams (*"They describe the outcome, and a set of coordinated agents figures out the steps"*). **What remains hard**: (1) **context management** in long sessions — **CLAUDE.md file quality** varies widely and weighs heavily on output quality; (2) **agentic security** = a fundamentally different model (agents that *act*, not just *suggest* → increased blast radius); (3) **evolving roles** (how do juniors become seniors if AI absorbs entry-level work? role of the designer/PM? the execution unit = scrum team → experiments with 1- or 3-person units). Conclusion: *"It changed what was economically possible"*; the stated ambition is **"the most automated, agentic SDLC in the industry"**. Directly intersects with Gupta (*cost of a completed outcome*, marginal token utility), Greenwald/Sierra (outcome-based pricing), DORA (ROI / cost per feature) and the BFM/Girard debate (token as a value fuel, not a cost to cut).
#Agentic SDLC#agentic SDLC#Claude Code
**Srinivas « Srini » Tallapragada** — *President and Chief Engineering and Customer Success Officer* de **Salesforce**. Plus d'une décennie chez Salesforce · dirige l'ingénierie mondiale de la plateforme unifiée. Auteur de la série *Agentic Enterprise* sur le blog Salesforce News ; ce billet (27 mai 2026) est la **suite** d'un premier opus consacré à l'adoption de l'IA par les milliers d'ingénieurs Salesforce (*« How we got our engineers to use AI — without breaking everything »*). Position d'autorité = **dirigeant exécutif** parlant en son nom et au nom d'une organisation d'ingénierie à grande échelle (donnée terrain à l'échelle d'un hyperscaler SaaS) · avec accès aux métriques internes (Engineering 360, Effective Output).