‘Vibe coding’ earned its name honestly. A developer describes what they want in plain language, an AI agent writes it, and the result is judged by whether it feels right rather than by its production quality. For a prototype, this is a superpower. The difficulty is that it works well enough to escape the prototype. Engineering teams are finding that the habits that make a demo possible do not survive contact with production systems, compliance requirements or customer expectations.
Three years ago, AI in software largely meant autocomplete. Then it meant agents capable of owning a task from end to end: picking up a ticket, editing files and opening a pull request without supervision. Large engineering organisations are now being pulled into a third era, in which AI must be orchestrated, metered, governed and audited like any other production system. That threshold is often crossed late, and usually after something has broken.
Four signals indicate the crossing has already happened. First, review has become the bottleneck. In a survey of 50 engineering leaders at US firms already using AI coding tools, the three most painful parts of the workflow were security and compliance review, code review and testing. Writing code ranked below all of them.
When code generation outruns verification capacity, more AI lengthens the queue instead of shortening it. Second, cost stops behaving like a predictable line item: Token consumption scales with ambition, task complexity and retries. Nearly half of surveyed leaders said they had limited visibility into AI spend, and a budget that cannot be forecast is not really a budget.
{{/usCountry}}When code generation outruns verification capacity, more AI lengthens the queue instead of shortening it. Second, cost stops behaving like a predictable line item: Token consumption scales with ambition, task complexity and retries. Nearly half of surveyed leaders said they had limited visibility into AI spend, and a budget that cannot be forecast is not really a budget.
{{/usCountry}}The third signal is that the question, "What did the AI actually do?" has no good answer.
Fourth, every developer has a private method. Ask five engineers how they use their agent and five different workflows emerge, producing results that colleagues cannot reproduce. When a better model arrives, adopting it means rewriting how everyone works. The lock-in that matters was never the model; it is the workflow built around it.
Underneath all four signals is a single change: The bottleneck has moved. For decades, the scarce resource in software was people who could write code. The scarce resource now is confidence that machine-speed code is correct, safe and explainable.
More than a third of surveyed leaders said governance concerns had already slowed or blocked AI adoption, making governance a live brake on value already paid for. Agents fail not only when given too little information, but when given too much, deciding what an agent should know is now an engineering discipline, not a matter of individual taste.
Structure does not mean reinstating the change advisory board. It means giving autonomy something to run inside: A layer that routes work to the right agent, applies consistent review and security gates, records what happened in a form an auditor can read and reports cost against outcomes. Agents should be replaceable, workflows portable and governance permanent.
Measurement is where most organisations go wrong, because the easiest numbers to collect are precisely the ones an AI agent can inflate without effort. Lines of code and pull request volume describe nothing useful the moment they become targets.
Five measures are more honest. Autonomy rate shows how much work an agent completes end to end without human intervention. Verification capacity ratio shows whether generated changes exceed what the organisation can genuinely review. Rework and change failure rates reveal whether speed is creating hidden debt. Cost per merged change matters more than total AI spend. Traceability coverage shows whether AI-authored changes carry a complete record of what was asked, produced and approved.
This lands with particular force in India, which runs a disproportionate share of the world's enterprise software delivery through global capability centres and services firms operating under contract. Ungoverned autonomy does not fail quietly in that setting. It fails contractually, in front of a client, with an audit trail that does not exist. That is also the opportunity. For a delivery organisation, the ability to demonstrate governed and measurable AI autonomy is not a cost saving to be passed along but a reason to be chosen, and a considerably more durable one than a rate card.
The move from vibe coding to structured, autonomous development is not a shift from human to machine. It is a shift from AI productivity to AI accountability. Teams are already vibe coding, and that question is settled. The only one remaining is whether their leaders find out from a dashboard or from an incident report.
(The views expressed are personal)
This article is authored by Prashanth Nanjundappa, VP, Product, Chief AI Officer Team, Progress Software.