AI-assisted delivery still needs the same governance discipline as everything else

There's a comforting idea going around that AI-assisted delivery is somehow exempt from the governance overhead that slows everything else down. The logic goes: an agent wrote the code, it passed the tests, ship it. Less process, more speed.

I don't buy it. AI-assisted delivery needs the same governance discipline as everything else, just applied to a new kind of contributor.

Governance in a delivery team was never really about slowing people down. It was about being able to answer three questions when something goes wrong: who decided this, why, and can we reproduce the reasoning. A RACI matrix, a decision log, an audit trail, these exist to answer those questions under pressure, usually during an incident, a compliance review, or a dispute with a supplier.

None of that need goes away because the "who" is an AI agent instead of a person. If anything the questions get harder to answer. A developer can usually explain, a few weeks later, why they wrote a piece of logic a certain way. An agent that generated a change from a prompt somebody typed in a hurry often can't be interrogated after the fact in the same way. The context that produced the decision is gone unless someone captured it deliberately.

So the practical governance questions for AI-assisted delivery aren't new in kind, only in detail:

• Who is accountable for a change an agent produced. Not the agent, a named person.
• Where is the prompt, and the reasoning behind it, logged, so someone can reconstruct why a change was made months later.
• What's the review gate before an agent-generated change reaches production, and who signs it off.
• How do you demonstrate, to an auditor or a regulator, that a decision made partly by a tool still went through the same approval path as one made entirely by a person.

I've built decision logs and governance frameworks for platform teams before AI entered the picture, mostly because "we can't remember why we did that" is a genuinely expensive problem once a platform spans multiple markets, multiple agencies, and multiple compliance regimes. Every one of those frameworks assumed the person making the decision could be asked about it later. AI-assisted delivery breaks that assumption quietly, unless you rebuild the habit of logging the decision, not just the output.

The teams getting this wrong aren't skipping governance because they think it's unnecessary. They're skipping it because the tooling moves fast enough that nobody stops to ask who's accountable for what the agent just did. That's not a smaller governance problem than the one you had before AI. It's the same one, with a new blind spot.