F ROM D ETERMINISM TO D ELEGATION : AI-NATIVE S OFTWARE E NGINEERING AND THE E VOLUTION OF THE AGENTIC E NGINEER
arXiv:2606.28791v1 [cs.SE] 27 Jun 2026
Mamdouh Alenezi Saudi Data and Artificial Intelligence (SDAIA) Riyadh, Saudi Arabia
June 30, 2026
A BSTRACT The software engineering profession is undergoing its most consequential structural transition since the adoption of high-level languages. As large language models (LLMs) acquire the capacity for sustained, multi-step, tool-mediated execution, the locus of engineering value is migrating from authoring deterministic code toward governing probabilistic, autonomous behavior. This position paper argues that “AI-Native Software Engineering” is not an incremental tooling upgrade but a paradigm shift that gives rise to a distinct professional archetype—the Agentic Engineer—whose primary artifact is the agentic system rather than the program. We characterize the shift along three axes: (i) a change in the unit of work from the function to the supervised agent workflow; (ii) a change in the correctness model from binary assertion to statistical evaluation under uncertainty; and (iii) a change in the accountability model from authorship to outcome ownership. Synthesizing peer-reviewed evidence published largely after 2022, we present a fourteen-dimension comparison of the traditional and agentic engineer, formalize the core mechanisms of autonomous software agents (reasoning–acting loops, context engineering, tool protocols, memory, behavioral drift, and compositional error), and locate human–AI collaboration within established socio-technical pillars. We deliberately foreground contested empirical findings—field experiments reporting double-digit productivity gains alongside a randomized controlled trial reporting a net slowdown for experienced developers—to argue that disciplined oversight, not raw automation, is the load-bearing competency. Drawing on globally recognized competency and governance standards (SFIA 9, CMU SEI, ISO/IEC 42001, IEEE 7000, NIST AI RMF), we map the competency ladder the role demands and the risk surface it introduces, including measured indirect-prompt-injection attack rates. We close with six falsifiable predictions and an agenda of open problems in evaluation, security, governance, and workforce formation. Our central claim is one of symbiosis, not substitution: the agentic engineer is constructed upon, and remains accountable through, classical engineering discipline.
1
Introduction
Software engineering has long been defined as the systematic practice of designing, building, testing, and maintaining software systems. Engineers analyze requirements, translate them into computational artifacts, and apply principles from computer science and engineering across increasingly complex technical environments [1, 2]. For decades, the discipline has largely operated under a deterministic model of computation: given a specified input, a correct program is expected to produce a specified output, with correctness established through mechanisms such as formal specifications, type systems, static analysis, and testing. Recent advances in artificial intelligence are beginning to alter this assumption. The emergence of agentic AI extends beyond generative systems focused on text or content production toward systems capable of reasoning, planning, using tools, and executing multi-step tasks under varying levels of human supervision [3–5]. Unlike earlier forms of developer assistance that primarily improved productivity through code completion or recommendation, contemporary
A PREPRINT - J UNE 30, 2026
agents increasingly participate in longer execution chains. They can identify faults, modify repositories, run tests, and iteratively refine solutions. Experimental results on software engineering benchmarks such as SWE-bench suggest that modern agent systems can already resolve a meaningful portion of curated real-world software issues [8, 9, 11]. These developments raise the possibility that portions of the software development life cycle (SDLC) may shift from direct human execution toward delegated autonomous processes [7, 12]. This paper argues that these changes are not merely incremental improvements in software tooling. Rather, they point toward an emerging paradigm that we describe as AI-Native Software Engineering. Within this paradigm, the engineer’s role evolves alongside increasingly capable software agents, giving rise to a distinct professional archetype that we refer to as the Agentic Engineer. This role should not be understood as replacing the traditional software engineer. Autonomous systems still depend on deterministic foundations, including reliable interfaces, secure infrastructure, high-quality data, and verifiable testing environments. Instead, the relationship between classical software engineering and agentic systems is better understood as complementary and mutually dependent [13]. Scope and epistemic status. This work is a position paper. Its goal is not to present a single empirical study, but to synthesize a rapidly evolving body of literature into a coherent argument and a set of testable predictions. Quantitative findings are drawn from the original studies we cite. Forward-looking claims are explicitly framed as hypotheses and discussed together with the supporting evidence and its limitations. Given the evolving state of the field, we also consider findings that challenge or complicate the proposed narrative. Contributions. The main contributions of this paper are as follows: (1) we frame AI-native software engineering as a paradigm shift along three conceptual dimensions (Sec. 3); (2) we synthesize a fourteen-dimension comparison between the traditional software engineer and the agentic engineer (Sec. 4); (3) we examine the mechanisms underlying autonomous software agents, including reasoning and action cycles, context and tool protocols, memory, behavioral drift, and compositional reliability (Sec. 5); (4) we situate human–AI collaboration and evaluation within broader socio-technical and verification perspectives while incorporating contested empirical findings (Secs. 6–7); (5) we map emerging competency and governance requirements to established standards and documented risks (Secs. 8–9); and (6) we propose a set of falsifiable predictions and identify open research challenges (Secs. 10–11).
2
Background and Related Work
Software engineering is a mature discipline with established professional definitions, standardized practices, and longterm workforce projections [1, 2]. Over several decades, the field has converged on core principles such as modularity, separation of concerns, and single responsibility, together with development processes that move from requirements and design toward implementation, testing, deployment, and maintenance. Although modern development practices differ in methodology and scale, they generally share a common assumption: software systems are constructed through deliberate engineering processes with clearly defined objectives and measurable notions of correctness. This stability provides an important reference point for understanding current changes in the field, since emerging forms of AIassisted development are appearing within an already mature engineering ecosystem rather than creating a discipline from scratch. At the same time, the increasing integration of artificial intelligence into production systems has led to the emergence of AI Engineering as a related but distinct area of practice. Rather than focusing solely on model development, AI Engineering emphasizes the reliable construction, deployment, and maintenance of AI capabilities in real-world environments [34]. Attention has shifted from isolated model performance toward broader concerns such as orchestration, retrieval systems, scalable data pipelines, operational reliability, and governance mechanisms. The Carnegie Mellon University Software Engineering Institute (CMU SEI) characterizes the field around three interconnected dimensions: Human-Centered AI, Robust and Secure AI, and Scalable AI [34]. This framing reflects a broader transition from controlled computational settings toward systems expected to operate in dynamic and uncertain environments. Recent advances in language models and autonomous systems extend these developments further and provide much of the technical foundation for the current agentic transition. The transformer architecture established attention as a general mechanism for sequence modeling [14], while subsequent work progressively expanded model capabilities beyond prediction alone. Chain-of-thought prompting demonstrated the value of intermediate reasoning steps for solving complex tasks [15]. ReAct introduced the interleaving of reasoning and actions within an external environment [16], Toolformer explored learned tool use [17], Reflexion introduced mechanisms for iterative self-correction [18], and retrieval-augmented generation grounded model outputs in external knowledge sources [19]. More recent cognitive architecture perspectives integrate these capabilities into a broader memory–reasoning–action framework for language agents [21]. 2
A PREPRINT - J UNE 30, 2026
Taken together, these developments transform language models from passive generators of text into systems capable of perception, planning, action, and revision across extended workflows [5–7]. Within software engineering contexts, these capabilities increasingly enable agents to participate directly in activities such as code generation, debugging, testing, and iterative problem solving. As human responsibilities move toward defining objectives, constraints, and quality expectations while agents execute increasingly complex tasks under supervision, a new mode of engineering practice begins to emerge. It is this evolving role that we describe throughout this paper as the agentic engineer.
3
The AI-Native Paradigm Shift
We characterize AI-native software engineering as a paradigm shift occurring across three related dimensions. The shift is not simply a matter of using AI-assisted tools within existing development practices. Rather, it reflects changes in how software work is structured, how system quality is evaluated, and how responsibility is assigned. These dimensions are closely connected: changes in one tend to influence the others. Together they suggest a transition from deterministic implementation practices toward forms of engineering centered on delegation, supervision, and probabilistic behavior. 3.1
Axis 1: The Unit of Work
In classical software engineering, the primary unit of work is deterministic code implementing a feature, service, API, or platform component. Engineers decompose systems into modules with clearly specified behavior and define explicit pathways connecting inputs and outputs. The development process therefore emphasizes decomposition, implementation, and verification of individual software artifacts. In agentic engineering, however, the primary unit increasingly becomes the agent workflow rather than the code artifact itself. The central design questions shift toward determining what an agent can perceive, which tools it may access, how it reasons about tasks, what modifications it is allowed to make, how outputs are evaluated, and under which conditions human intervention becomes necessary [5, 7]. Rather than prescribing every computational step, the engineer shapes the operating environment within which the system acts. This distinction represents a meaningful conceptual change. Traditional systems expose behavior through explicitly designed execution paths, while agent systems generate behavior through interactions among prompts, memory, tools, and environmental context. Outcomes emerge from the interaction between a stochastic policy and its surrounding constraints rather than from a fully specified sequence of instructions. Consequently, engineering effort moves away from constructing individual behaviors toward constructing the conditions under which desirable behaviors are likely to arise. 3.2
Axis 2: The Correctness Model
Changes in the unit of work naturally alter the way correctness is defined and evaluated. Classical software systems generally rely on binary notions of correctness: a function either produces the expected result or it does not. Correctness can therefore be verified locally through assertions, tests, and formal specifications. Such approaches work well in environments where expected outputs can be precisely defined. Agentic systems often operate under fundamentally different conditions. Many tasks involving reasoning, planning, or content generation do not admit a single deterministic output. Consequently, correctness becomes statistical and system-level rather than binary and local. Performance is increasingly measured through evaluation pipelines that report metrics such as task success rate, faithfulness, tool-use accuracy, and hallucination frequency, with judgments often derived from automated evaluators operating over curated benchmark datasets [22, 24]. The practical implications are significant. A system achieving a task success rate of 94% may be entirely acceptable in one setting while being unusable in another. Decisions about deployment therefore become dependent not only on absolute performance but also on the consequences of failure. The central engineering question shifts from asking ‘Is the system correct?” toward asking ‘Is the system sufficiently reliable under realistic operating conditions, and are its failure modes acceptable?” [32]. 3.3
Axis 3: The Accountability Model
As systems become capable of performing increasingly autonomous actions, responsibility structures also change. In traditional specification-driven development, accountability is closely linked to authorship. Engineers implement systems directly, and ownership naturally follows from the code they create and maintain. 3
A PREPRINT - J UNE 30, 2026
Table 1: A Fourteen-Dimension Comparison of the Software Engineer (SWE) and the Agentic Engineer (AE) Dimension
Software Engineer (SWE)
Agentic Engineer (AE)
Core paradigm
Deterministic, imperative; given input X, output Y is guaranteed (modulo bugs). Features: functions, services, schemas, UI components. Code implementing a feature. Languages, data structures, system design, networking, CI/CD. IDEs, Git, Docker/Kubernetes, SQL/NoSQL, observability stacks. Layered or microservices; explicit data flow; deterministic error handling. MVC, event-driven, CQRS, serverless.
Probabilistic, goal-driven; behavior emerges from a stochastic policy under guardrails. Autonomous capabilities: agents that plan, act, recover, and escalate. A supervised agent workflow. The above plus LLM internals, prompting, memory, tools, evaluation, alignment. Plus orchestration frameworks, vector stores, tracing, and guardrail libraries. Cognitive loop: perceive → reason/plan → act → observe → update memory. ReAct, plan-and-execute, router–worker, hierarchical / multi-agent. Experiment-heavy; trace-driven; no terminal “done” (behavior drifts). Evaluations: LLM-as-judge, trajectory evaluation, semantic similarity; statistical. Cognitive tracing: why a tool was chosen, where reasoning derailed, context overflow. Prompt injection, jailbreaking, data exfiltration; HITL gates, permission scoping. Owns the outcome; delegates first-pass work but owns final review and intent. Plus task success, tool-execution success, eval pass rate, approval rate, safety incidents. Systems thinker comfortable with ambiguity; CS + cognitive science + linguistics.
Primary output Unit of work Knowledge domain Tooling Architecture Design pattern
Debugging
Spec → design → implement → test → deploy; clear “done.” Unit / integration / E2E; assert; coverage; binary. Stack traces, logs, queries; locate the faulting line.
Security
Injection, XSS, broken auth; perimeter defense.
Accountability
Owns code designed, reviewed, merged, deployed. Speed, defect rate, reliability, performance, maintainability. Logical, structured; comfortable with binary rules.
Life cycle Testing / QA
Success metrics Mindset
AI-native environments introduce a more complex relationship between action and responsibility. Autonomous agents may generate code, review pull requests, summarize incidents, identify defects, or propose modifications, but they do not assume responsibility for outcomes. Human engineers retain ownership over the resulting systems and remain accountable for decisions affecting quality, security, and production readiness [7, 12]. The engineer’s role therefore shifts from direct implementation toward supervision and governance. Human involvement increasingly centers on establishing constraints, defining acceptance criteria, and validating system behavior before deployment. Governance mechanisms such as auditability, approval workflows, and intervention policies consequently become architectural requirements rather than operational afterthoughts. In AI-native systems, responsibility does not disappear as autonomy increases; rather, responsibility becomes concentrated around oversight and outcome ownership.
4
The Agentic Engineer: Role Anatomy
We compress the distinction into a single proposition: software engineering builds the system; agentic engineering builds the agentic system that helps build, operate, and evolve the system. Software engineers are optimized for deterministic design and implementation; agentic engineers are optimized for orchestrating probabilistic collaborators safely and productively [33]. Table 1 synthesizes the contrast across fourteen dimensions; the dimensions are drawn from the agent and software-engineering surveys cited throughout and are intended as an analytical scaffold rather than an empirically validated taxonomy. The overlap is substantial: both write code, use version control, and reason about distributed systems. But the weighting differs. The agentic engineer’s scarce skill is judgment—writing a specification precise enough for an agent to execute, then detecting the plausible-but-wrong output that a deterministic test would never flag. We note explicitly 4
A PREPRINT - J UNE 30, 2026
Goal & Context
Environment / Tools
Reason / Plan block / revise
approve
Act (tool call)
Observe
propose
HITL gate?
Memory update
Figure 1: The canonical agentic loop. A human-in-the-loop (HITL) gate mediates consequential or irreversible actions before they reach the environment; a blocked action is routed back for revision, and memory updates close the cycle.
that the common claim “senior engineers adapt more readily” is a hypothesis, not a settled finding; controlled evidence on which cohorts benefit is mixed and is examined in Sec. 6.
5
Autonomous Software Agents: Architectures and Mechanisms
5.1
The Reasoning–Acting Loop
The fundamental building block of an autonomous agent is a closed cognitive loop. The agent perceives an observation ot , reasons over its context and memory, selects an action at (often a tool call), executes it, and incorporates the resulting observation ot+1 . Formally, the agent approximates a policy π over a partially observable decision process, at ∼ π(a | st ) ,
st+1 = f (st , at , ot+1 ) ,
(1)
where the state st aggregates the goal, accumulated context, and retrieved memory. ReAct instantiates Eq. (1) by interleaving natural-language reasoning with tool actions [16]; plan-and-execute decomposes the goal first and then dispatches sub-tasks; and hierarchical or multi-agent topologies assign a manager to coordinate specialized workers, as in collaborative multi-agent programming frameworks [6, 10, 20]. Figure 1 depicts the canonical loop and its supervision point. 5.2
Context Engineering and the Attention Cost
Because transformer self-attention scales quadratically with sequence length, managing the input payload is central to latency and cost. The scaled dot-product attention underlying the architecture is QK ⊤ Attention(Q, K, V ) = softmax √ V, (2) dk with queries Q, keys K, and values V derived from dense embeddings and dk the key dimension [14]. Context engineering—semantic chunking, retrieval, reranking, and compression—is therefore not a convenience but an economic and reliability discipline: it determines what grounding the agent receives, what it costs, and how exposed it is to hallucination. Retrieval-augmented generation [19] and graph-structured retrieval are the dominant grounding strategies. 5.3
Tool Protocols: The Model Context Protocol
Connecting heterogeneous models to proprietary tools historically required bespoke connectors. The Model Context Protocol (MCP), introduced in late 2024, replaces N ×M custom integrations with a single client–server contract [35]. An MCP Host manages consent and policy; an MCP Client connects to individual servers; and an MCP Server exposes read-only Resources, executable Tools validated by JSON Schema and gated by human approval, and reusable Prompts. Standardized tool protocols are what allow agents (built by agentic engineers) to discover and act upon the deterministic APIs (built by software engineers)—the technical seam of the symbiosis. 5
A PREPRINT - J UNE 30, 2026
Psuccess = p n
1 p = 0.99 p = 0.95 p = 0.90 p = 0.80
0.8 0.6 0.4 0.2 0 0
2
4
6
8
10
12
14
16
18
20
number of dependent steps n
Figure 2: Compositional reliability under the independence assumption of Eq. (5). High per-step success rates decay rapidly over multi-step horizons, motivating trajectory-level evaluation and human checkpoints rather than reliance on per-step accuracy. 5.4
Concurrency Under I/O-Bound Workloads
Foundation-model workloads are dominated by waiting on remote inference, vector lookups, and external fetches; synchronous execution creates severe bottlenecks. Production agentic systems therefore depend on asynchronous concurrency—parallel dispatch with error resilience, connection pooling, and rate-limiting semaphores to manage provider backpressure—a software-engineering competency repurposed in service of agentic reliability. 5.5
Behavioral Drift
Unlike deterministic software, agentic systems degrade through drift. Let Ptrain denote the training distribution and Pprod the production distribution. Data drift is a shift in the marginal input distribution, Pprod (x) ̸= Ptrain (x),
(3)
Pprod (y | x) ̸= Ptrain (y | x).
(4)
while concept drift is a shift in the conditional,
Because the underlying model may also be updated by its provider, an agent has no stable terminal state; it requires permanent stewardship and automated statistical monitoring under testing, evaluation, verification, and validation (TEVV) regimes [34]. 5.6
Compositional Reliability
A distinctive and underappreciated failure mode is the multiplicative decay of reliability over long horizons. If an agent must complete n dependent steps and each step succeeds independently with probability p, then under the (optimistic) independence assumption the end-to-end success probability is Psuccess (n) = p n ,
(5)
so that a seemingly strong per-step rate of p = 0.95 yields only Psuccess (20) ≈ 0.36. Figure 2 plots this decay for several per-step rates. Equation (5) is an upper bound in practice—errors are often correlated and can cascade—which is precisely why trajectory-level evaluation, recovery, and human checkpoints (rather than per-step accuracy alone) govern usable autonomy.
6
Human–AI Collaboration Models
Autonomy is not binary but a spectrum of supervised agency. The CMU SEI Human-Centered pillar holds that AI systems are socio-technical artifacts that must align with human needs and establish explicit boundaries where decision authority remains with human operators, particularly in high-stakes domains [34]. In practice, deployment progresses through graduated trust: shadow mode (the agent proposes, a human disposes), human-in-the-loop checkpoints for consequential actions, and bounded autonomy within scoped permissions. Figure 3 situates common patterns along this spectrum. 6
A PREPRINT - J UNE 30, 2026
Assist
HITL gate
Shadow
Bounded
low autonomy
Full
high autonomy
human authority ↓
agent initiative ↑
governance burden ↑
Figure 3: The supervised-agency spectrum. Most enterprise deployments in regulated domains operate left of “Bounded,” reserving destructive actions behind human-in-the-loop gates. Table 2: Selected Controlled Evidence on AI-Assisted Software Work Study
Design
N
Headline effect
Peng et al. 2023 [28]
Lab experiment, bounded task Three field RCTs Telemetry + survey RCT, expert OSS devs
95
−55.8% completion time (faster)
4,867 ∼2,000 16
+26.1% tasks; larger for juniors Acceptance rate tracks perceived gain +19% completion time (slower)
Cui et al. 2026 [29] Ziegler et al. 2024 [30] Becker et al. 2025 [31]
6.1
What the Controlled Evidence Actually Shows
The productivity case for delegation is real but heterogeneous, and the evidence is contested. Table 2 summarizes four representative studies. A lab experiment found that developers completed a bounded JavaScript task 55.8% faster with an AI assistant [28]; three large field experiments at Microsoft, Accenture, and a Fortune 100 firm reported a combined 26.08% increase in completed tasks across 4,867 developers, with the largest gains accruing to less experienced developers [29]. Yet a randomized controlled trial of 16 experienced open-source developers on their own mature repositories found that early-2025 AI tools increased task completion time by 19%—even though the same developers had forecast a 20–24% speedup [31]. The juxtaposition is the point: gains concentrate on well-scoped tasks and lower-context cohorts, while high-context expert work can incur net costs. This is the empirical basis for our thesis that oversight and calibrated judgment, not raw automation, are the load-bearing competencies, and that a perception–reality calibration gap is itself a managed risk. The collaboration is bidirectional. Agents act as first-pass implementers across planning, implementation, testing, review, documentation, and operational triage, compressing coordination cycles; humans retain architecture, product intent, and final quality judgment. The deeper gain, where it materializes, is cognitive leverage: fewer handoffs and less rediscovery of system knowledge, freeing engineers for higher-order problems.
7
Evaluation, Trust, and Verification
If evaluation is an afterthought in classical practice, it is the central artifact in agentic practice. Because outputs are non-deterministic, quality is established through curated evaluation datasets—including adversarial edge cases—and automated grading. Three complementary techniques dominate: LLM-as-a-judge, in which a capable model grades outputs against a rubric [22]; trajectory evaluation, which asks whether the agent chose a correct sequence of tools even when the final answer varies; and semantic similarity against golden datasets. Crucially, the dominant grading mechanism is itself imperfect, and rigor requires acknowledging this. Surveys and empirical studies document that LLM judges exhibit systematic biases—position, verbosity, and self-preference among them—and that judge choice can reorder model rankings [23,24]. Using a model to grade models therefore introduces a circularity that calibration, reference anchoring, and judge ensembling only partially mitigate. Robustness must consequently be quantified through TEVV frameworks that exceed static accuracy and evaluate reaction to data, model, and intent drift [34]. Trust, in turn, depends on traceability: the ability to audit the inference path of any machine decision, capturing inputs, prompt schemas, model parameters, and human validation checkpoints. This requirement connects evaluation directly to governance (Sec. 9). 7
A PREPRINT - J UNE 30, 2026
Table 3: Agentic-Engineering Practice Mapped to SFIA 9 Responsibility Levels Level
Representative agentic-engineering activity
1 Follow 2 Assist 3 Apply
Execute deterministic commands via generative assistants; report interface failures. Run document loading and semantic chunking; unit-test established model APIs. Author asynchronous integration code; configure vector databases; build typed prompt templates. Implement parameter-efficient fine-tuning; construct multi-agent state loops; configure evaluation pipelines. Architect CI/CD for models; establish observability; deploy scalable containerized systems. Lead ISO/IEC 42001 and NIST AI RMF audits; design secure multi-cloud architectures; audit bias mitigation. Define organizational technology, data, and security architectures; govern model portfolios.
4 Enable 5 Ensure 6 Initiate 7 Strategy
8
Competency and Workforce Implications
The role expands rather than replaces the engineering competency ladder. Using the Skills Framework for the Information Age (SFIA 9), competency is recognized through demonstrated skill in real work across seven levels of responsibility, from Follow (Level 1) to Set Strategy (Level 7) [39]. Table 3 maps agentic-engineering practice onto these levels. The progression is instructive: entry levels execute deterministic commands and standard pipelines, mid-levels construct multi-agent loops and evaluation pipelines, and senior levels architect observability and establish ISO/IEC 42001 and NIST AI RMF conformance. A defensible competency model decomposes performance into Technical skills, Soft skills, Knowledge, and Abilities across domains such as model adaptation and orchestration, retrieval and context engineering, infrastructure, and trustworthy AI. The behavioral dimension is non-trivial: problem solving under epistemic uncertainty and collaborative design with multidisciplinary stakeholders sit alongside transformer internals and vector mathematics. Curricular guidance is beginning to respond—the ACM/IEEE-CS/AAAI CS2023 guidelines specify baseline AI study within the core computer-science curriculum [40]—but professional-grade practice demands continuous upskilling to counter rapid stack churn. Notably, educators increasingly argue that curricula should prioritize problem definition, system design, and debugging/evaluation over code authoring, cultivating judgment rather than transient tool fluency—a stance consistent with the evidence in Table 2 that value migrates toward oversight.
9
Governance, Risk, and Agentic Security
Agentic systems introduce failure modes absent from deterministic software: a system may do the wrong thing even when its code is syntactically correct, because the agent misinterprets intent, selects the wrong tool, loses context, or acts with excessive autonomy. The risk is amplified by agency itself. Under indirect prompt injection, a poisoned document or web page can induce an agent to misuse a legitimate tool—for instance, exfiltrating data via an email capability. This is not hypothetical: a foundational study classified the attack class and demonstrated compromise of real LLM-integrated applications [25], and tool-integrated benchmarks have since quantified the exposure, with one finding ReAct-prompted GPT-4 agents successfully attacked in roughly 24% of cases [26] and dynamic environments enabling systematic evaluation of attacks and defenses [27]. Defenses therefore differ in kind from classical perimeter security: strict tool-permission scoping, output guardrails, sandboxed execution, and human-in-the-loop checkpoints for destructive actions. These controls are codified by three complementary standards, summarized in Table 4. ISO/IEC 42001 establishes an auditable AI management system foregrounding accountability and traceable decision logging [36]. The IEEE 7000 series operationalizes ethics as value engineering, requiring that stakeholder values be translated into traceable technical requirements [37]. The NIST AI RMF provides a continuous Govern–Map–Measure–Manage life cycle and articulates characteristics of trustworthy AI [38]. The throughline is that governance is integrated into architecture rather than appended to it.
10
Predictions as Falsifiable Hypotheses
We advance six predictions, each stated as a falsifiable hypothesis with its supporting evidence and the observation that would refute it. 8
A PREPRINT - J UNE 30, 2026
Table 4: Complementary AI Governance Frameworks Framework
Mechanism and engineering implication
ISO/IEC 42001
Organizational AI management system; structured controls, audits, decision logging; mandates accountability and traceability. Value-engineering process; elicits stakeholder values and traces them to technical requirements and verification metrics. Continuous Govern–Map–Measure–Manage life cycle; trustworthy-AI characteristics; risk profiles and measurement.
IEEE 7000 NIST AI RMF
H1: Convergence into the AI-native software engineer. The sharp SWE/AE distinction will partially dissolve into a hybrid archetype, with mainstream engineers expected to orchestrate coding agents by default. Evidence: broad enterprise adoption of AI coding assistants [29, 30]. Refutation: sustained bifurcation into disjoint, separately hired roles. H2: First-pass execution across the SDLC. Agents will increasingly perform first-pass analysis, implementation, and test expansion while humans steer, review, and own. Evidence: agent performance on real-issue benchmarks [8, 9]. Refutation: agents remain confined to autocompletion without repository-level action. H3: Effects remain strongly heterogeneous. Net benefit will continue to depend on task scoping and developer context, not improve uniformly. Evidence: the divergence between field gains and the expert-developer slowdown in Table 2 [29, 31]. Refutation: convergent, uniformly positive effects across cohorts and task types. H4: Evaluation and reliability become a named discipline. Dedicated roles for evaluation, observability, cost monitoring, and incident response will consolidate—an “SRE for agents” specialization—because un-architected agent systems accrue cost and fail audits [24, 34]. Refutation: evaluation remains an ad hoc task with no role formation. H5: The economics of change reshape architecture. By lowering the cost of modification, agentic engineering turns prior one-way design decisions into two-way doors, encouraging experimentation; competitive advantage migrates to judgment and direction. Refutation: modification costs and architectural conservatism remain unchanged. H6: Standards-driven governance becomes a hiring filter. Demonstrable fluency with ISO/IEC 42001, IEEE 7000, and the NIST AI RMF will increasingly distinguish enterprise-ready engineers as auditability becomes a procurement prerequisite [36–38]. Refutation: governance fluency remains irrelevant to hiring in regulated sectors.
11
Challenges and Open Problems
Several problems remain unresolved and merit research and practitioner attention. Evaluation validity. LLM-as-judge introduces circularity and documented bias; trajectory metrics may reward spurious tool sequences [23,24]. Establishing construct-valid, reproducible, contamination-resistant evaluations for open-ended tasks is an open methodological problem [32]. Compositional reliability. As Eq. (5) and Fig. 2 show, multi-step systems compound per-step error; principled methods for bounding end-to-end reliability under correlated failures are needed. Security under agency. Indirect prompt injection, tool misuse, and data exfiltration constitute a threat class with measurable success rates and immature defenses [25–27]. Provenance, capability scoping, and verifiable guardrails require further formalization. Accountability attribution. When an agent proposes and a human approves, responsibility allocation is legally and ethically unsettled, especially across vendor-supplied model updates that silently alter behavior. Workforce formation. Curricula and certification taxonomies lag practice [39, 40]. Cultivating judgment, system design, and evaluation literacy at scale—rather than transient tool skills—is a non-trivial educational challenge. Sustained stewardship. Drift implies that “done” is obsolete; the cost model of permanent monitoring, re-evaluation, and re-alignment is not yet well understood at the portfolio level. 9
A PREPRINT - J UNE 30, 2026
11.1
Threats to Validity
As a synthesis, this paper inherits the limitations of its sources. The controlled-evidence base is small, recent, and tied to specific tool generations; effect sizes such as those in Table 2 should be read as time-stamped snapshots rather than stable constants. The fourteen-dimension comparison (Table 1) is an analytical construct, not an empirically validated instrument. Forecasts in Sec. 10 concern a fast-moving field and are offered as falsifiable hypotheses. We have sought to mitigate selection bias by reporting disconfirming evidence, but residual bias toward the published, English-language literature remains.
12
Conclusion
AI-native software engineering marks a transition from authoring deterministic systems to governing probabilistic, autonomous ones. The emerging agentic engineer differs from the classical software engineer in the unit of work, the correctness model, and the accountability model, and is best understood not as a successor but as a complement: agents are the means of production for the agentic engineer and, increasingly, a product in their own right, yet they remain dependent on the deterministic substrates, secure interfaces, and verifiable discipline that software engineering provides. The defensible position is therefore one of symbiosis. The controlled evidence cautions against triumphalism—value accrues unevenly and can reverse for expert work on complex systems—which is exactly why human oversight, evaluation literacy, and governance become the scarce, durable competencies. As machines absorb more of the writing, human value migrates toward specification, evaluation, and ownership of outcomes, and the profession’s enduring task becomes deciding what is worth building and verifying that it was built right.
References [1] E.-M. Grote, C. Koldewey, S. E. Schwarz, R. Dumitrescu, and A. Albers, “Enabling Better Systems Through Better Teams: 27 Role Profiles for Engineering Advanced Systems,” in Proc. IEEE Int. Conf. Eng., Technol. Innov. (ICE/ITMC), 2025, pp. 1–9, doi:10.1109/ICE/ITMC65658.2025.11106533. [2] U.S. Bureau of Labor Statistics, “Software Developers, Quality Assurance Analysts, and Testers,” Occupational Outlook Handbook, 2024. [Online]. Available: https://www.bls.gov/ooh/ computer-and-information-technology/software-developers.htm [3] Y. K. Dwivedi et al., “Agentic AI Systems: What It Is and Isn’t,” Global Business and Organizational Excellence, vol. 45, no. 3, pp. 253–263, 2026, doi:10.1002/joe.70018. [4] L. Hughes et al., “AI Agents and Agentic Systems: A Multi-Expert Analysis,” Journal of Computer Information Systems, vol. 65, no. 4, pp. 489–517, 2025. [5] L. Wang et al., “A Survey on Large Language Model Based Autonomous Agents,” Frontiers of Computer Science, vol. 18, no. 6, art. 186345, 2024, doi:10.1007/s11704-024-40231-1. [6] T. Guo et al., “Large Language Model Based Multi-Agents: A Survey of Progress and Challenges,” in Proc. 33rd Int. Joint Conf. Artif. Intell. (IJCAI), 2024, pp. 8048–8057, doi:10.24963/ijcai.2024/890. [7] J. Liu, K. Wang, Y. Chen, X. Peng, Z. Chen, L. Zhang, and Y. Lou, “Large Language Model-Based Agents for Software Engineering: A Survey,” arXiv:2409.02977, 2024. [8] C. E. Jimenez, J. Yang, A. Wettig, S. Yao, K. Pei, O. Press, and K. Narasimhan, “SWE-bench: Can Language Models Resolve Real-World GitHub Issues?” in Proc. Int. Conf. Learning Representations (ICLR), 2024. [9] J. Yang, C. E. Jimenez, A. Wettig, K. Lieret, S. Yao, K. Narasimhan, and O. Press, “SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering,” in Advances in Neural Information Processing Systems (NeurIPS), vol. 37, 2024. [10] S. Hong et al., “MetaGPT: Meta Programming for a Multi-Agent Collaborative Framework,” in Proc. Int. Conf. Learning Representations (ICLR), 2024. [11] Y. Zhang, H. Ruan, Z. Fan, and A. Roychoudhury, “AutoCodeRover: Autonomous Program Improvement,” in Proc. 33rd ACM SIGSOFT Int. Symp. Software Testing and Analysis (ISSTA), 2024, pp. 1592–1604, doi:10.1145/3650212.3680384. [12] A. N. Saha and D. Patra, “AI-First Software Development Lifecycle: An Agent-Driven Framework for Autonomous Planning, Coding, Testing, and Deployment,” ESP Journal of Engineering & Technology Advancements, vol. 6, no. 1, pp. 131–139, 2026. 10
A PREPRINT - J UNE 30, 2026
[13] F. R. Cogo, G. A. Oliva, and A. E. Hassan, “Compiler.next: A Search-Based Compiler to Power the AI-Native Future of Software Engineering,” ACM Trans. Software Engineering and Methodology, 2026, doi:10.1145/3802581. [14] A. Vaswani et al., “Attention Is All You Need,” in Advances in Neural Information Processing Systems (NeurIPS), 2017, pp. 5998–6008. [15] J. Wei et al., “Chain-of-Thought Prompting Elicits Reasoning in Large Language Models,” in Advances in Neural Information Processing Systems (NeurIPS), vol. 35, 2022, pp. 24824–24837. [16] S. Yao et al., “ReAct: Synergizing Reasoning and Acting in Language Models,” in Proc. Int. Conf. Learning Representations (ICLR), 2023. [17] T. Schick et al., “Toolformer: Language Models Can Teach Themselves to Use Tools,” in Advances in Neural Information Processing Systems (NeurIPS), vol. 36, 2023. [18] N. Shinn, F. Cassano, A. Gopinath, K. Narasimhan, and S. Yao, “Reflexion: Language Agents with Verbal Reinforcement Learning,” in Advances in Neural Information Processing Systems (NeurIPS), vol. 36, 2023. [19] P. Lewis et al., “Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks,” in Advances in Neural Information Processing Systems (NeurIPS), vol. 33, 2020, pp. 9459–9474. [20] Q. Wu et al., “AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation,” in Proc. Conf. Language Modeling (COLM), 2024. [21] T. R. Sumers, S. Yao, K. Narasimhan, and T. L. Griffiths, “Cognitive Architectures for Language Agents,” Transactions on Machine Learning Research (TMLR), 2024. [22] L. Zheng et al., “Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena,” in Advances in Neural Information Processing Systems (NeurIPS), vol. 36, 2023. [23] J. Gu et al., “A Survey on LLM-as-a-Judge,” arXiv:2411.15594, 2024. [24] D. Li et al., “From Generation to Judgment: arXiv:2411.16594, 2024.
Opportunities and Challenges of LLM-as-a-Judge,”
[25] K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection,” in Proc. 16th ACM Workshop on Artificial Intelligence and Security (AISec), 2023, pp. 79–90, doi:10.1145/3605764.3623985. [26] Q. Zhan, Z. Liang, Z. Ying, and D. Kang, “INJECAGENT: Benchmarking Indirect Prompt Injections in ToolIntegrated Large Language Model Agents,” in Findings of the Association for Computational Linguistics (ACL Findings), 2024, pp. 10471–10506. [27] E. Debenedetti, J. Zhang, M. Balunović, L. Beurer-Kellner, M. Fischer, and F. Tramèr, “AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents,” in Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track, vol. 37, 2024. [28] S. Peng, E. Kalliamvakou, P. Cihon, and M. Demirer, “The Impact of AI on Developer Productivity: Evidence from GitHub Copilot,” arXiv:2302.06590, 2023. [29] Z. Cui, M. Demirer, S. Jaffe, L. Musolff, S. Peng, and T. Salz, “The Effects of Generative AI on HighSkilled Work: Evidence from Three Field Experiments with Software Developers,” Management Science, 2026, doi:10.1287/mnsc.2025.00535. [30] A. Ziegler et al., “Measuring GitHub Copilot’s Impact on Productivity,” Communications of the ACM, vol. 67, no. 3, pp. 54–63, 2024, doi:10.1145/3633453. [31] J. Becker, N. Rush, B. Barnes, and D. Rein, “Measuring the Impact of Early-2025 AI on Experienced OpenSource Developer Productivity,” Model Evaluation & Threat Research (METR), arXiv:2507.09089, 2025. [32] I. Badertdinov et al., “SWE-rebench: An Automated Pipeline for Task Collection and Decontaminated Evaluation of Software Engineering Agents,” in Advances in Neural Information Processing Systems (NeurIPS), 2025. [33] D. Horne, “The Agentic AI Mindset: A Practitioner’s Guide to Architectures, Patterns, and Future Directions for Autonomy and Automation,” in Proc. Int. Conf. AI Revolution, Cham: Springer Nature Switzerland, 2025, pp. 434–455. [34] Carnegie Mellon University Software Engineering Institute, “AI Engineering,” 2024. [Online]. Available: https://www.sei.cmu.edu/artificial-intelligence-engineering/ [35] Anthropic, “Introducing the Model Context Protocol,” 2024. [Online]. Available: https://www.anthropic. com/news/model-context-protocol 11
A PREPRINT - J UNE 30, 2026
[36] International Organization for Standardization, ISO/IEC 42001:2023 – Information Technology – Artificial Intelligence – Management System, 2023. [37] IEEE, IEEE 7000-2021 – IEEE Standard Model Process for Addressing Ethical Concerns During System Design, 2021. [38] National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, 2023. [39] SFIA Foundation, Skills Framework for the Information Age (SFIA 9), 2024. [Online]. Available: https:// sfia-online.org/ [40] ACM/IEEE-CS/AAAI Joint Task Force, Computer Science Curricula 2023 (CS2023), ACM Press, 2024, doi:10.1145/3664191.
12