Building the Agentic SDLC: Autonomous AI Teams and Enterprise Infrastructure

The Agentic SDLC: How AI Teams Debate, Code, and Secure Enterprise Infrastructure

The Agentic Software Factory utilizes a multi-round V3 AI Debate Protocol to move from raw issues to hardened Pull Requests. In this implementation, agents successfully built a cryptographic Transaction Token capability for WSO2 IS 7.2.0 based on RFC 9396 and RFC 9449.

Why This Matters

While most organizations use AI as a synchronous autocomplete tool, the technical reality requires asynchronous, agentic workflows to handle complex enterprise security. Without multi-agent consensus and specialized review lenses, relying on a single model for critical infrastructure risks catastrophic security failures and technical debt from hallucinations, particularly when modifying legacy systems like Identity Providers.

Key Insights

• The V3 AI Debate Protocol forces consensus between models like Claude and Gemini to avoid single-prompt hallucinations in architectural design (2026).
• A Tri-Model Review Pipeline uses specialized personas—Architect, QA Engineer, and SecOps Auditor—to deduplicate findings and ensure RFC compliance.
• Event-driven orchestration via GitOps triggers autonomous execution in an isolated OpenCode runtime using Gitea as the central source of truth.
• Decoupled HTTP pre-issue actions are prioritized over brittle OSGi Java plugins to ensure long-term maintainability and fault isolation for enterprise IDPs.
• Cryptographic binding via DPoP (RFC 9449) and Rich Authorization Requests (RFC 9396) is used to limit the blast radius of autonomous agent tokens.

Practical Applications

• Use Case: WSO2 IS 7.2.0 integration using a decoupled HTTP pre-issue action service to implement DPoP and Rich Authorization Requests. Pitfall: Using a tightly coupled OSGi plugin which leads to brittle upgrades and high technical debt.
• Use Case: Automated PR reviews using three distinct models—Claude, Gemini, and Codex—to catch edge cases and security vulnerabilities. Pitfall: Allowing an agent to grade its own homework, which misses operational blast radius issues and malformed JSON handling.

References:

• https://dev.to/uenyioha/the-agentic-sdlc-how-ai-teams-debate-code-and-secure-enterprise-infrastructure-5ge9