AI Pilot Experience · Controlled Development

Coding-Agent Workflow Prototype

Build a small internal prototype, importer, validation script, dashboard, or review queue against synthetic or approved data inside an isolated workspace with independent human acceptance.

Start Free Workflow Assessment Review Bounded AI Agent Pilot

Operating brief

Starting point: Approved project rules, behavior specification, implementation plan, task list, synthetic or approved data, isolated repository, acceptance tests, and technical reviewer.
Pilot output: Prototype code, discovery register, approved specification, dependency and licence record, tests, review evidence, limitations, runbook, source history, and client-owned handover.
Authority: The coding agent prepares changes and tests; an accountable person independently reviews and accepts the prototype, dependencies, data handling, and any later deployment.

Pilot experience

See what the user does, what the system prepares, and what the pilot must prove.

A narrow prototype can reveal workflow sequence, missing information, confusing states, repeated actions, accessibility barriers, and recovery needs before production architecture or procurement is approved. The validated discoveries are reusable; the prototype implementation may require substantial refactoring or replacement.

Claude Code, Codex, Gemini CLI, Cursor, Aider, or Cline can inspect an isolated repository, prepare code, run restricted tools, and collect test evidence against synthetic or explicitly approved data.

The same agent does not accept its own work. Human technical review, dependency and licence review, security checks, representative tests, and client-owned handover remain required.

Visual walkthrough

Follow the workflow, review interface, evidence, and decision states.

Each view shows how source records, system outputs, exceptions, corrections, and human decisions remain connected during the pilot.

Coding prototype workflow. — Coding prototype workflow
Approved inputs remain connected to preparation, deterministic checks, human review, acceptance, and release.

Change and test register. — Change and test register
Stable source, run, output, version, evidence, correction, and review records remain visible.

Dependency review. — Dependency review
Reviewers inspect claims, actions, files, dependencies, geometry, behavior, and prohibited implications before acceptance.

Prototype exception queue. — Prototype exception queue
Uncertainty, failure, permission, security, rights, validation, and stop conditions receive named owners and states.

Reviewed prototype package. — Reviewed prototype package
Only accepted outputs move to the approved audience or next controlled environment.

User journey

Move from approved collection to source-linked review through explicit stages.

The interface can feel simple while the pilot preserves document identity, revision, permission, retrieval, uncertainty, and review evidence behind every result.

Approve project rules

Freeze simplicity, accessibility, data handling, security, dependency, testing, ownership, and handover rules for the prototype.

Specify the behavior

Define users, inputs, required outputs, acceptance scenarios, edge cases, exclusions, prohibited actions, and explicit non-goals.

Record prototype discoveries

Link each user observation, workflow issue, missing control, assumption, and proposed requirement to evidence, reviewer, rationale, owner, acceptance test, and accepted, rejected, deferred, or unresolved status.

Specify invisible controls

Add separation of duties, restricted fields, cross-project boundaries, duplicate prevention, calculations, concurrency, migration, retention, security, incident, and recovery behavior that a walkthrough may not reveal.

Approve plan and tasks

Review architecture, records, interfaces, dependencies, tests, rollback, and dependency-ordered tasks before implementation.

Isolate workspace

Create a non-production repository or branch with restricted identity, filesystem, commands, network, secrets, tools, and cleanup.

Prepare incrementally

Create small reviewable changes linked to approved requirements and tasks, with prompt, tool, command, file, diff, test, error, retry, and decision records.

Validate deterministically

Run formatting, types, unit, integration, fixture, security, dependency, accessibility, performance, and representative workflow checks as applicable.

Independent review

A named person inspects requirements, code, dependencies, data flows, outputs, failures, tests, and unresolved issues.

Accept prototype

Record what passed, failed, remains excluded, requires production design, and is accepted only for the stated demonstration.

Handover

Deliver source, history, environment, fixtures, tests, evidence, dependency record, runbook, limitations, and exit route client-owned.

Technology options

Choose each component for a defined task and accepted output.

The final selection records exact versions, licences, data handling, cost, limitations, replacement options, and the evidence required before use.

Component	Examples	Pilot role	Boundary
Claude Code	Approved Claude Code version, model, permissions, sandbox, settings, and tools	Inspect the isolated repository, prepare changes, run tests, and explain evidence.	Local execution can still send approved context to a hosted model and cannot self-authorize acceptance.
Codex	Approved Codex local, CLI, cloud, or delegated environment	Prepare and test prototype changes inside the selected execution boundary.	Local, remote, and cloud surfaces differ in files, network, identity, retention, and approval.
Gemini CLI	Versioned official Gemini CLI with approved model, extensions, commands, and policy	Offer a replaceable coding-agent route for representative evaluation.	Repository access and command execution require the same sandbox, secrets, dependency, and review controls.
Cursor	Approved Cursor editor, agent, indexing, model, rules, and terminal settings	Support repository-aware editing and reviewable prototype work.	IDE convenience does not establish dependency safety, test adequacy, or acceptance.
Aider or Cline	Versioned tool, provider, model, plugins, permissions, and configuration	Provide additional eligible local-agent harnesses where their controls match the brief.	Open source or local installation does not by itself establish model privacy, package safety, or production permission.

Client-owned pilot outputs

The pilot closes with evidence and a decision, not just a demonstration.

Versioned project rules covering simplicity, accessibility, data, security, dependencies, testing, ownership, and handover
Behavior specification covering users, inputs, outputs, scenarios, edge cases, exclusions, prohibited actions, non-goals, and acceptance
Prototype discovery register linking observation, source evidence, role, workflow step, proposed requirement, reviewer, rationale, owner, status, and next test
Approved implementation plan and dependency-ordered task list linked to requirements and tests
Repository, branch, workspace, identity, filesystem, command, network, secret, provider, and cleanup controls
Agent, model, harness, runtime, package, dependency, licence, fixture, configuration, lockfile, and version register
Prompt, tool, command, file, diff, test, error, retry, correction, and decision history
Formatting, type, unit, integration, fixture, security, dependency, accessibility, performance, and workflow tests
Requirement gap, failing test, dependency issue, secret exposure, unsafe command, data error, and unresolved-risk queue
Normal, malformed, duplicate, missing, large, adversarial, permission, failure, recovery, and regression cases
Technical review, correction, rejection, accepted prototype, production-design-needed, expiry, and withdrawal states
Quality, critical failure, reviewer effort, build time, and complete cost evidence
Source, history, environment, fixtures, tests, evidence, dependency record, runbook, limitations, and exit route

Evaluation evidence

Measure retrieval, citations, review effort, latency, and complete cost together.

A fluent answer is not the acceptance unit. The pilot tests whether a reviewer can reach the controlling evidence efficiently and detect important failure.

Source support

Trace outputs to approved sources, actions, files, references, versions, and evidence.

Task completion

Measure completion against frozen cases and acceptance criteria, including difficult and stop cases.

Critical failure

Record unauthorized action, false claim, security event, dependency issue, missing evidence, or prohibited use.

Reviewer effort

Measure inspection, correction, rerun, exception resolution, testing, and approval time.

Accepted output

Count outputs accepted by accountable reviewers, not processing completion or model agreement.

Complete cost

Include models, tools, compute, storage, preparation, testing, review, correction, monitoring, support, and replacement.

Cost drivers

Cost follows document condition, usage, controls, and accepted outcomes.

Source and output volume, formats, revisions, media duration, portals, repositories, assets, scenes, and update frequency
Model, API, browser, compute, GPU, rendering, storage, transfer, build, test, retry, and provider-plan cost
Permissions, rights, identity, environments, schemas, prompts, scripts, fixtures, validation, manifests, and acceptance preparation
Security, privacy, confidentiality, secrets, network, region, retention, training use, dependency, licence, and incident review
Process, technical, security, subject, communications, accessibility, legal, and release review
Corrections, reruns, exceptions, monitoring, support, provider changes, expiry, withdrawal, portability, and handover

Scaling factors

Scale one accepted pattern without flattening project and industry differences.

Volume

Use durable source, run, work-item, output, review, correction, acceptance, release, expiry, and withdrawal IDs with queues and checkpoints.

Permissions

Constrain source, identity, credential, tool, repository, file, network, provider, destination, audience, and action scope.

Environment

Version models, APIs, browsers, tools, packages, dependencies, engines, operating systems, hardware, settings, tests, and policies.

Provider replacement

Keep approved sources, prompts, scripts, records, assets, tests, evidence, corrections, and accepted outputs client-owned.

Concurrency

Measure queues, sessions, rate limits, rendering, build time, timeouts, retries, reviewer capacity, and cost.

Production promotion

Require separate security, integration, monitoring, recovery, service, rights, ownership, training, and deployment approval.

Cross-industry reuse

Reuse the retrieval pattern while changing documents, authority, and review.

The reusable capability is permission-aware multilingual retrieval across versioned documents with citations. Each industry keeps its own source authority, terminology, consequence, retention, and qualified review.