After code stops being the bottleneck, the scarce resource is encodable judgment

In August 2026 Anthropic published The AI-Native SDLC playbook. Its central claim is that organizations can now write code with AI at a speed unthinkable a year earlier, while the approvals, handoffs and policies around that code have not been rewritten at the same pace. The playbook still describes the lifecycle as six stages—Plan, Design, Build, Test, Deploy, Maintain—and argues that committed artifacts (intent.md, spec.md, plan.md, the diff, review findings) should turn those stages into a loop.

The diagnosis holds. The disagreement is about the unit of change. The playbook treats transformation as six plays plus a markdown commit chain. The scarce resource is the rate at which an organization encodes irreversible judgments as machine-checkable constraints. Without that, an AI-native SDLC is a faster waterfall with better filenames.

What the playbook gets right

Three observations hold. First, the bottleneck moves: once Build collapses to hours, Plan, review/test and Deploy still run at human speed. Second, controls break: line-by-line human review made sense when a person wrote every line; it cannot keep up once agents write most of the diff. Third, artifacts become evidence: each stage commits a file the next stage can read, and the commit history is the audit trail of who asked, what the agent produced, and who approved.

These points come from the public playbook, not independent fieldwork. The controls it names are also concrete: CLAUDE.md, skills, hooks, managed permissions, a production gate, and the rule that the agent that wrote the code cannot approve it. Those should stay.

The premise is the problem. The playbook assumes the organization already knows what it must enforce—brand, security, compliance and release authority already exist as skills or hooks. Most enterprises stall here. They can adopt agentic coding. Their policies still live in meeting notes and in the heads of particular reviewers, and encoding lags the rate at which agents generate exceptions.

Three ways to see the SDLC

Encodable judgment, not faster stages

Encodable judgment is not a longer requirements document. It is an irreversible decision written as a rule the agent must obey while acting, that a deterministic check can block when violated, and that a named owner will defend. The playbook's distinction between advisory controls (skills) and deterministic ones (hooks) matters more than the six-stage diagram: skills make violations rare; hooks make them nearly impossible.

Judgment-encoding rate measures the time from “this rule must hold” to a hook, an eval, or branch protection. If that interval is still measured in weeks or months, while agents emit changes in hours, governance cost rises. The playbook itself notes that exceptions still queue for committees that meet weekly or monthly. Generation accelerates. Authorization does not.

The artifact fallacy

Committing intent.md is easily mistaken for having made a product decision. The playbook is right to require a product owner to review and correct the agent-written intent before commit, and to record accept or reject as a merge or a closed review. The requirement is also fragile. When intent arrives from an alert, a ticket or an on-call channel, the reviewer faces a complete-looking file. Stamping it is cheaper than thinking on a blank page.

That is the artifact fallacy: the audit trail records that an approval occurred, not that the approver understood it. Markdown that both a person and an agent can read is an advantage; it does not mint judgment. The playbook already says a skill is advisory and that a policy which must always hold needs a hook or a review pass. Institutional knowledge as files is a local maximum. Files encode yesterday's mistakes. They do not encode when to break the rule.

Closing the loop is the last five percent, not the definition

The playbook presents Maintain as the completed loop: a deterministic script watches production, invokes the model without a person in the path when a control band is breached, writes the finding as intent.md, and re-enters the pipeline. That is a coherent operations pattern once controls are encoded, rollback is rehearsed, and permission tiers are frozen.

It should not define “AI-native.” It should be the last slice of maturity. Keeping detection deterministic is one of the playbook's clearest sentences: the model should not decide whether a band was breached. Automatically opening work after every breach produces a self-licking loop—noise writes intent, intent consumes review bandwidth, bandwidth pressure trains people to click through. A closed loop amplifies encoded judgment. It also amplifies unencoded bias.

Measure authorization, not only throughput

The playbook already names metrics closer to the constraint than merge count; it just lists them as accessories to each play: the survival rate of intent.md files accepted into Design; how often an intent is rewritten after the first spec.md for the same change; time from a policy owner's approval to the updated skill merging; review findings that cite the policy, which should fall toward zero. Those should not sit behind “changes merged per engineer per week.”

Optimize only delivery frequency and concurrent sessions, and the organization will get more diffs waiting for a signature. The better questions are: how many irreversible decisions are already gates? How many still live on a meeting calendar? Until the second list shrinks, raising agent autonomy only moves the bottleneck from the keyboard to the pen.