Case study: running Claude Code through a regulated-industry SDLC with 3 CI gates and 5 human approvals
rseroter · x · 2026-11-06
Netguru details an AI-assisted SDLC for a multi-tenant SaaS platform in a regulated industry (.NET/React on Azure), where Claude Code handles everything from spec to release.
Key practices
- All steering material (instructions, rules, skills, hooks) lives in the repo and changes only via reviewed PRs
- Three levels of CI gates plus five human decision points tie every change to a requirement, a test, and a release for a full audit trail
- 8-step flow: roadmap → spec → requirements (business approval, locked) → design (ADR) → phased builds (TDD, subagents, hook risk blocks) → PR (tests, SAST/SCA, advisory AI review) → UAT/release gate → reflection
- The agent holds no permission a junior engineer wouldn't; same quality gates apply regardless of who wrote the code
Takeaway: compliance-heavy teams can let an agent do the execution if the control layer lives in git and humans sit at a few approval points.
More from coding & agent
- Dev essay: why a runaway intelligence explosion isn't the risk — 'early onset decoherence' is — round · 2026-11-06
- Sardine launches Know Your Human protocol to verify humans behind shopping agents — astrange · 2026-11-06
- Indie dev cuts 5,672 lines rebuilding trip planner's Days screen into one-drag editing — SeanOliver · 2026-11-06
- LangChain details optimizing browser use for deep agents; design agent fixes its own blog formatting — LangChain · 2026-11-06
- Baker Lab + NVIDIA unveil RFD4-Proteina: agents run protein design tool calls on GFP — AllThingsApx · 2026-11-06
- New Compound Writing skill PR lands on GitHub, pending testing before merge — kieranklaassen · 2026-11-06