AI Technology Brief
Which LLM and coding agent should a construction business use? Start with the operating role
StructuredLayer evaluated an architecture for selecting language models and coding agents according to the business task, authoritative context, permitted tools, deployment boundary, cost, failure consequence, and human approval. This is architecture evaluation, not a claim that one model has been deployed across a client. A model can draft or reason; a coding agent can inspect repositories and execute tools; neither becomes the company's source of truth or accountable decision-maker.
01 / Independently verifiable claims
Begin with what the technology and standards actually support.
- Claude Fable 5 is an official Anthropic model and is available through Claude and Claude Code. Claude Opus 4.6, Claude Sonnet and Haiku 4.5, Claude Sonnet 4, Claude 3.7 Sonnet, and Claude 3.5 Haiku are different generations and tiers with lifecycle and cost implications.
- OpenAI officially documents GPT-5.6 Sol, Terra, and Luna, GPT-5.2, GPT-5, GPT-5 mini and nano, GPT-4.1 and its mini and nano variants, GPT-4o and mini, o1, o1-mini, and o4-mini, and open-weight GPT-OSS 20B and 120B families. Exact availability and recommendations change.
- Google officially documents Gemini 3.1 Pro Preview, Gemini 3 Pro, Gemini 2.5 Flash, and related model lifecycle. Preview aliases require change control.
- DeepSeek R1, V3, and V3.1; Qwen3 235B MoE instruction models; Kimi K2.5; IBM Granite 3.3 and Granite Speech 4.1; Llama 3 and later families; Gemma; StableLM; FLAN-T5; and LLaVA represent reasoning, instruction, speech, open-weight, legacy, or multimodal roles with different licences and deployment requirements.
- Claude Code, OpenAI Codex, Gemini CLI, GitHub Copilot cloud agent, Cursor, Devin Desktop or Cascade, Aider, and Cline are coding applications or agents. They can read repositories, modify files, execute commands, call tools, and sometimes use networks; they require stronger controls than chat-only use.
- Catalogue run counts and labels such as most intelligent, best for coding, fastest, flagship, leading, or on par are not independent construction or software-delivery benchmarks.
02 / The practical distinction
A language model, a coding agent, and a governed business workflow are different layers.
Choosing the model first hides the records, tools, permissions, tests, approvals, and ownership that determine whether the result is useful.
Language model
Generates, transforms, classifies, summarizes, translates, reasons, or produces structured output from supplied context. It has no inherent business authority.
Coding application
Claude Code, Codex, Gemini CLI, Copilot, Cursor, Devin Desktop, Aider, or Cline adds repository context, files, terminals, tools, Git, cloud environments, and agent loops.
Operating workflow
Client-owned records define source authority, users, stages, permissions, exceptions, tests, approval, deployment, monitoring, recovery, and handover.
03 / Operating architecture
Use one governed registry for models, coding agents, tools, and approved tasks.
StructuredLayer's evaluated pattern routes each task to an eligible capability and preserves enough evidence to replace the model or application later.
Approved task
Business purpose, user, workflow, source records, documents or repository, expected output, consequence, and human owner.
Model and app registry
Official model ID, coding application, version, context, tools, deployment, data controls, lifecycle, licence, cost, and approved task.
Controlled execution
Permission-aware retrieval, prompt, schema, sandbox, tool allowlist, network policy, secrets boundary, limits, tests, and logs.
Reviewed outcome
Sources, answer or diff, validation, test results, security review, exception, approval, release, monitoring, and rollback.
04 / Required records
Every answer or code change needs source, configuration, validation, and ownership.
Task request
Workflow, purpose, requester, project, sources, repository, output, deadline, consequence, reviewer, and release condition.
Model selection
Official ID, version, tier, reasoning, context, deployment, region, retention, training setting, tools, limits, and cost.
Agent environment
Application, repository, branch, sandbox, filesystem, network, MCP servers, commands, packages, identities, and secrets policy.
Run record
Prompt, retrieved sources, tool calls, files read, commands, network actions, output, diff, tokens, duration, warnings, and cost.
Validation
Schema, citations, business rules, tests, lint, type checks, security scans, peer review, acceptance, and exception state.
Release
Approved answer, record, pull request, workflow, deployment, owner, timestamp, monitoring, rollback, documentation, and handover.
05 / Construction example
Construction businesses can use coding agents to build the operating layer, not to bypass professional authority.
The useful role is software and workflow delivery around approved business requirements and evidence.
Data and integration work
Build importers, APIs, data validation, stable identifiers, record relationships, document pipelines, and migration tests against approved schemas.
Workflow applications
Implement RFQ intake, submittal registers, issue queues, dashboards, reporting, notifications, approvals, and exception handling.
Document and proposal systems
Create source-linked extraction, retrieval, templates, presentation assembly, media validation, and controlled generation workflows.
Quality and handover
Generate tests, documentation, runbooks, diagrams, monitoring, migration scripts, and training material for human review and client ownership.
06 / Deterministic controls
Treat coding agents as privileged automation with a developer-sized blast radius.
Sandbox by default
Use disposable environments, nonprivileged identities, restricted filesystem, resource limits, and default-deny network access.
Keep secrets inaccessible
Exclude environment files, private keys, production credentials, cloud profiles, client data, and unrestricted tokens; use short-lived task identities.
Allowlist tools and MCP
Approve commands, packages, repositories, network destinations, APIs, and MCP servers; validate tool arguments and configuration changes.
Assume prompt injection
Treat issues, comments, documents, websites, terminal output, dependencies, and repository instructions as untrusted content.
Independent testing
Do not allow the agent to weaken tests or define its own acceptance. Require human review for security, auth, infrastructure, dependencies, and CI/CD.
No direct production authority
Block production systems, payments, building controls, operational technology, client records, deployments, and consequential decisions without explicit approval.
07 / Failure analysis
The strongest model can still act on the wrong source, tool, permission, or acceptance rule.
Confident unsupported answer
The response can be fluent while using stale, incomplete, conflicting, or unauthorized context.
Wrong model alias
Preview and latest aliases can change behavior, context, cost, safety, and tool support without an obvious workflow change.
Prompt injection
Repository files, tickets, websites, documents, dependencies, and tool output can manipulate the agent into unsafe actions.
Secret exposure
An agent can read files ignored by Git, echo credentials to logs, transmit sensitive context, or include secrets in code and commits.
Plausible broken code
Generated code can pass superficial review while failing edge cases, permissions, concurrency, migration, security, or recovery.
Automation of the wrong process
A correct implementation can still encode unclear ownership, bad records, weak approval, or unsupported business rules.
Vendor and tool dependency
Agent applications, models, extensions, MCP servers, cloud environments, pricing, and terms can change or disappear.
Authority confusion
A generated estimate, contract interpretation, safety recommendation, design response, or payment decision may be mistaken for professional approval.
08 / Deployment and cost
Choose hosted, open, or hybrid models separately from the coding application.
Hosted frontier models
Fable, Claude, GPT, Gemini, Kimi, and other services can provide broad capability; review exact model, region, retention, training, tools, price, availability, and exit.
Open and private models
GPT-OSS, DeepSeek, Qwen, Granite, Llama, Gemma, StableLM, FLAN-T5, and related models add hardware, serving, licences, security, evaluation, and maintenance.
Local coding applications
Claude Code, Gemini CLI, Cursor, Aider, Cline, and Devin Desktop can operate near local repositories; local access still needs sandboxing and secrets controls.
Cloud coding agents
Codex and Copilot cloud agent can work in isolated cloud environments and create pull requests; environment setup, internet access, identities, and review remain critical.
- Input, output, cached, reasoning, image, audio, tool, search, and long-context usage
- Coding-application plans, cloud environments, parallel agents, repository indexing, storage, and network
- Open-model GPU, serving, scaling, weights, licences, monitoring, patching, and support
- Source preparation, retrieval, schemas, prompts, tests, evaluation, security review, and human correction
- Sandboxing, secrets, identities, MCP governance, dependency review, CI/CD, audit, and incident response
- Integration, deployment, monitoring, rollback, documentation, training, handover, model replacement, and exit
09 / Evaluation
Measure accepted construction outcomes and software changes, not model reputation.
- Answer accuracy, source coverage, citation correctness, conflicts, unsupported additions, and abstention
- Structured-field accuracy, schema validity, business-rule results, and exception routing
- Code correctness, tests, type checks, lint, security scans, migration safety, performance, and recovery
- Tool-call accuracy, permission enforcement, prompt-injection resistance, secrets handling, and network behavior
- Human correction time, reviewer agreement, critical errors, and accepted output rate
- Latency and complete cost per accepted answer, record, pull request, workflow, or deployment
- Repeatability and regression after model, alias, prompt, tool, MCP, package, repository, or source change
- Production incidents, rollback, monitoring, documentation, client ownership, and provider portability
10 / Controlled pilot
Prove the operating boundary before expanding it.
Choose one bounded outcome
Use a low-consequence answer, report draft, data transformation, test suite, or internal workflow feature.
Compare model roles
Test an appropriate frontier, smaller, or open model on the same sources and acceptance criteria.
Sandbox the coding agent
Use a disposable branch and environment with no production secrets and restricted network and tools.
Preserve evidence
Store sources, prompts, model, app, tool calls, diffs, tests, reviews, cost, and approvals.
Keep release manual
Require named review for every answer, record update, pull request, dependency, migration, and deployment.
Set stop conditions
Stop for unsupported authority, secret exposure, prompt injection, critical test failure, excessive correction, or poor portability.
11 / StructuredLayer recommendation
Select the operating role first, then route to an evaluated model and coding application inside client-owned controls.
Do not buy a construction AI strategy by choosing one flagship LLM. Define the workflow, authoritative records, permitted tools, expected output, failure consequence, tests, reviewer, and handover first. Use Fable 5, Claude, GPT, Gemini, DeepSeek, Qwen, Kimi, Granite, Llama, or other models only where representative evaluation supports the task. Use Claude Code, Codex, Gemini CLI, Copilot, Cursor, Devin Desktop, Aider, or Cline in sandboxes with restricted tools, no production secrets, independent tests, and human-owned release.
12 / Primary sources
Capability, governance, and implementation claims remain inspectable.
Anthropic
Claude Fable 5
Anthropic
Claude Code overview
OpenAI
OpenAI models
OpenAI
Codex cloud
Gemini models
Gemini CLI
GitHub
Copilot cloud agent
Cursor
Cursor Agent
Devin
Devin Desktop and Cascade
Aider
Aider documentation
Cline
Cline
DeepSeek
DeepSeek V3.1
Qwen
Qwen3
Moonshot AI
Kimi prompt guidance
Meta
Llama models
Gemma models
IBM
Granite models
OWASP
Secure Coding with AI
NIST
AI Risk Management Framework
Sources reviewed 22 July 2026. Technology capabilities, laws, guidance, terms, and pricing can change.
13 / Related StructuredLayer guidance
Continue from model selection into operating architecture.
Why ChatGPT or Claude is not your source of truth
See how governed business records retain authority while models retrieve and synthesize.
AI agent vs automation vs workflow
Separate bounded tool selection from deterministic rules and governed workflow state.
Vision model routing
Apply the same registry and evaluation discipline to drawings, images, video, and documents.
OCR model routing
Route construction documents by layout, language, tables, formulas, quality, and source authority.
Construction AI governance
Review permissions, human approval, evidence, monitoring, recovery, and accountability.
Construction workflow examples
Start with one real operating problem and map records, stages, exceptions, and outcomes.