Increasingly, code production can now be performed by AI agents, with humans taking a step back. This raises a legitimate question: where does the human belong when agents write code, and how do we secure a way of working where much happens automatically?

What characterizes the agent-driven development loop?

A recurring pattern is a three-step loop:

Intent – people define goals based on, for example, requirements.
Agent loop – agents produce code in a feedback loop with minimal human intervention, through a mix of AI, traditional (deterministic) scripts and DevOps tools.
Reviews – people do risk-proportional quality assurance and move on to deployment, or send feedback back to the loop.

One way to balance risk and speed is to classify each change by risk. A high-impact change may require multiple mandatory human reviewers, while a well-defined and harmless change may go through with fewer, if any, reviews.

What protections do we need in the loop?

From a security perspective, four things in particular appear to be important to automate to a high degree, often with the help of AI:

– Safety feedback to those who formulate the goals (intent). Are we giving agents enough context to understand the threat model and the non-functional security requirements, such as the authorization model?
– Security review of produced code inside the agent loop. Ensure that the code is improved in line with the goals until it is ready for verification (review).
– Risk assessment of the changes that are ready for verification. Fast, accurate risk classification is a key factor in maintaining high speed without compromising safety.
– Security feedback to those verifying changes. Is the change ready for acceptance testing and deployment? Are compliance and security requirements met?

Common to automation in these steps is the need for a technically detailed and accurate threat model that spans infrastructure configuration, code, logs, documentation, and requirements. Without that context, the agent lacks the ability to make secure decisions with the right risk assessment.

How do we build a safe way of working?

The foundation is the same as for all secure system development: well-established principles and patterns such as Secure by Design, Defense in Depth, Zero Trust and Least Privilege. The difference is that we now need to weave them into a way of working where a large part of the code is produced automatically, and where the controls need a high degree of automation to meet the demands for a higher pace of development.

The amount of human resources needed, primarily in the intent and review stages, needs to be proportional to the business’s threat model and risk appetite. Just because other teams choose to run fully automated in ”YOLO mode” doesn’t mean it’s right for you!

If you want to read more about responsibility and risk when AI acts, we also recommend AI Agents and the New Reality: Reflections from RSAC 2026, Whose responsibility is it when AI makes mistakes? and How dangerous is it to let AI-based agents into your own systems?.

For more in-depth information, there is material on Omegapoint's security blog, including an article about agent-driven application security and a blog post about why context is crucial.