# In the Land of AI Agents, the Verifiers Are King Tariq Shaukat, Sonar | AI Engineer World's Fair 2026 | 18:53 Source: https://www.youtube.com/watch?v=VrpEyglYgeU Channel: AI Engineer (https://www.youtube.com/@aiDotEngineer). Summarised by AIE Talks. Page: https://aietalks.com/talks/in-the-land-of-ai-agents-the-verifiers-are-king Published: 2026-07-20 Tags: agents, coding-agents, reliability, security, testing ## TL;DR - AI coding agents can complete much longer tasks, but their higher task completion rates often hide correctness, security, complexity, and maintainability problems. - The Agent-Centric Development Cycle puts Guide, Verify, and Solve into the software development process, with verification running inside agentic work rather than after it. - Clean codebases and active maintenance make agents cheaper and more effective, while neglecting verification causes technical debt and quality problems to compound. ## Summary Tariq Shaukat argues that the hard part of enterprise AI is no longer generating plausible output. It is determining whether that output is correct and safe. Coding agents are improving quickly, but benchmark success rates can conceal bugs, security issues, and complex code. A Carnegie Mellon study he cites found an initial three to five times boost in velocity that dissipated after three months as technical debt and maintenance problems grew. Shaukat presents Sonar's Agent-Centric Development Cycle, or AC/DC, with three stages: Guide agents with codebase context and constraints, Verify their work through zero-trust and multi-layered checks, and Solve problems through ongoing code maintenance. He argues that verification needs to be built into agentic, CI, and maintenance loops. In one large bank, he says this approach produced a 92% reduction in issues. The talk is aimed at teams with substantial existing codebases and enterprise requirements. ## Key ideas ### Higher agent task completion rates do not prove that the resulting code is production-ready [02:58](https://www.youtube.com/watch?v=VrpEyglYgeU&t=178s) Shaukat shows coding-agent benchmarks where the latest model can complete tasks that would take humans 16 to 18 hours, but that figure uses a 50% success rate. At an 80% accuracy threshold, the comparable task length drops to about three and a half hours. He says an enterprise would not consider information from someone who is right only 80% of the time to be acceptable. Sonar's own tests across more than 4,000 problems found strong functional correctness, while complexity remained high and the models still produced bugs and security issues. The point is that completing a task is different from completing it correctly. ### AI coding productivity gains disappear when technical debt grows as fast as code [06:14](https://www.youtube.com/watch?v=VrpEyglYgeU&t=374s) Shaukat cites a Carnegie Mellon study that found an initial three to five times increase in productivity or velocity from AI coding agents. That gain dissipated after three months. During the same period, security, maintainability, reliability, and complexity problems increased. The resulting technical debt created a new bottleneck, so the team eventually lost the initial velocity advantage. Shaukat uses this pattern to argue that verification cannot remain an afterthought or be limited to traditional code review. Teams need to control the quality of generated code while the work is being produced. ### The AC/DC framework puts Guide, Verify, and Solve around code generation [08:28](https://www.youtube.com/watch?v=VrpEyglYgeU&t=508s) Shaukat introduces the Agent-Centric Development Cycle, abbreviated AC/DC. Code generation remains inside the process, but it is surrounded by disciplines, tools, and processes that guide the agent, verify its outcomes, and solve the problems that appear. Guide supplies the agent with the information and boundaries it needs. Verify checks the generated work. Solve maintains the codebase and addresses technical debt. Shaukat says these activities need to become part of the software development life cycle rather than optional steps performed after an agent finishes. ### Guidance combines codebase context with explicit constraints [09:31](https://www.youtube.com/watch?v=VrpEyglYgeU&t=571s) The Guide stage has two distinct parts. Context helps an agent understand repositories, architecture, semantic navigation maps, and the structure of a large codebase. Constraints describe coding standards, approved and forbidden dependencies, guardrails, and the intended architecture. Shaukat says teams often explain the existing architecture but fail to tell the agent where the system should go. He mentions Sonar Vortex, launched the day before the talk, as a product aimed at this area. In Sonar's testing, giving agents context and constraints produced a large improvement in effectiveness and reduced the tokens needed to solve a problem by more than 30%. ### Verification should use zero trust and several independent layers [11:25](https://www.youtube.com/watch?v=VrpEyglYgeU&t=685s) Shaukat recommends treating every model with zero trust because models have biases and distinct failure patterns. Verification should combine different models and techniques. The layers include algorithmic checks for data flows, control flows, known patterns, and secrets, along with agentic checks for intent, business logic, and unknown problems. He says software is too complex and messy for one kind of check to cover everything. Partners and customers using this multi-layered approach reported that AI-derived production outages were 44% less frequent than among those who did not use it. ### Maintenance is part of agentic development because agents also suffer from messy codebases [12:58](https://www.youtube.com/watch?v=VrpEyglYgeU&t=778s) Shaukat says technical debt expands as agents generate code, so teams need an active process for verified code maintenance. He rejects the idea that clean code matters only to human developers. Agents must understand a codebase before they can operate on it, and cleaner code reduces the tokens, reasoning, and energy required for the same tasks. He describes the effect as compounding: maintaining the codebase makes future agent work easier. Remediation agents and a strong verification discipline can help keep the codebase clean instead of allowing generated debt to accumulate. ### Verification belongs in three connected loops [14:32](https://www.youtube.com/watch?v=VrpEyglYgeU&t=872s) Shaukat describes a system with an agentic loop, a continuous integration verification loop, and a code maintenance loop. During the agentic loop, the system supplies context and constraints, performs in-loop verification, and helps fix problems while the agent is working. The CI loop combines algorithmic and agentic checks for pull requests, code review, evaluations, and quality gates. The maintenance loop keeps the codebase in shape. He says these loops reinforce outcomes over time. Neglecting verification and maintenance can create a downward spiral, while deliberate verification creates compounding benefits. ### A disciplined Guide, Verify, Solve process produced a large reduction in issues at one bank [16:50](https://www.youtube.com/watch?v=VrpEyglYgeU&t=1010s) Shaukat describes a test with a large bank using advanced agentic coding tools. He says the bank achieved a 92% reduction in issues by applying the Guide, Verify, Solve approach inside its agentic loops. He clarifies that the figure does not mean each individual loop was 92% better. The benefit compounded as the team solved problems over minutes and hours. He presents this as the controlled way to create value from AI in enterprises with existing codebases, including organizations with millions of lines of code. ## Notable quotes - "The struggle is that AI slop is everywhere." (01:55) - "The models are amazing as we just heard, but the hard part as the other target just said is getting value out of it." (01:55) - "The core part is deliberate verification built into the system." (17:57) - "If you make the life of the agent easier, if you maintain your codebase, then you'll actually see compounding effects." (14:26) ## Tools & references mentioned - Sonar Vortex - Carnegie Mellon University - KPMG - EY - Google Cloud - Bumble - GPT-5.5 - Fable - AC/DC - Agent-Centric Development Cycle ## Who should watch - You are introducing coding agents into an enterprise codebase and need a process for checking their output before quality problems accumulate. - Your initial AI-assisted development speed has started to fall as security, maintainability, reliability, or complexity issues increase. - You want practical guidance on combining code intelligence, static analysis, agentic review, CI checks, and code maintenance.