Building a Control Framework for the AI SDLC

Kosli

Jul 17, 2026

AI coding tools are in use across regulated industries, producing workable code faster than humans can review. It’s a shift that’s raising difficult questions that haven’t been fully answered yet.

What does governance look like when AI agents are writing the code, reviewing each other’s work, and fixing their own findings? How do you prove what code is running and whether it passed your checks? Who’s accountable for change approvals, audits, incidents?

Alex Kantor has spent years as a Director of Technology in financial services. He’s building an experimental agentic software delivery pipeline to explore how we can govern the new, lightning fast AI SDLC.

In this video, Alex Kantor (Director of Technology, Kosli) shares the full journey - from switching on Copilot reviews to building a 16-persona, multi-model review panel with a cryptographically audited trail, and what it taught him about making tacit controls explicit enough for machines to follow.

👉 Get the Secure SDLC process template: https://www.kosli.com/secure-sdlc-process-template/

⏱ Video Timeline

00:00 – Intro: are your controls ready for AI agents?

01:20 – The peanut butter problem: instructions vs assumptions

03:00 – The journey: AI writing more of our code

04:00 – Testing Copilot and Claude as reviewers

05:13 – Why we built our own PR reviewer

06:36 – How it works: 16 personas, two models, policy as code

09:34 – Assumption 1: the reviewer read the whole change

12:37 – Assumption 2: the findings are real

14:20 – Assumption 3: the reviewer applies your standards

16:45 – Assumption 4: one good reviewer is enough