# Guide, Verify, Solve — Anirban Chatterjee, Sonar

## Executive summary

As AI-driven development moves from experimentation to engineering, the primary challenge is 'verification debt'—the gap between the quality provided by LLMs and the high reliability required for critical production systems. The speaker argues that relying solely on human review (which can be compromised, as shown by a Wharton study) or the generating model itself is insufficient. A robust solution requires implementing a zero-trust, multi-layered verification regime within agentic development loops to ensure code quality across syntax, data flow, architecture, and control flow.

## Key takeaways

- Implement Zero Trust Verification: Assume all code (human or AI) could come from anywhere. Verification must use a different methodology than the one that wrote the code to prevent inheriting blind spots.
- Adopt Multi-Layered Review: No single technique is sufficient; verification must combine computational review, LLM-driven reasoning, and other approaches to catch all types of issues (quality, security, compliance).
- Use ACDC for Agentic Loops: The proposed framework is the Agent-Centric Development Cycle (ACDC), which includes three phases: Guidance (providing constraints/guardrails), Verification (running independent checks in real time), and Solve (allowing the agent to remediate issues).
- Standardize Verification Across Projects: Organizations should establish a single, consistent verification platform that applies uniformly across all teams, projects, and AI coding tools to eliminate blind spots.

## Technical details

- AI Productivity Plateau: A Carnegie Mellon study found that while using an AI tool (like Cursor) caused a temporary spike in productivity, the gain lasted only about three months due to persistent increases in static analysis warnings and code complexity. This accumulation of issues is termed 'verification debt.'
- LLM Limitations: Models are inherently error-prone, lack full context (e.g., business objectives or prior meetings), and exhibit diverse quality issues, necessitating external verification.
- Model Comparison: The LLM leaderboard shows that different models perform differently: Claude Sonnet may be good for correctness, while Opus might be better for maintainability or security, requiring model selection based on task criticality.
- Automated CI/CD Integration: The process requires verification in both the inner agentic loop and the outer CI/CD loop. Tools like SonarQube run automated reviews on PRs, assigning grades for quality, security, and maintainability to gate deployment.
- New Agentic Capabilities: Sonar has released 'Sonar Vortex,' which provides agents with tools in the inner loop to run real-time verification as code is being written. They also launched a remediation agent to tackle technical debt automatically.

## Practical implications

- Integrate automated verification tools (like SonarQube) as mandatory quality gates in both the inner agentic development loop and the outer CI/CD pipeline.
- Define clear architectural constraints, coding standards, and quality criteria *before* initiating any LLM coding task to provide necessary context and guardrails.
- Utilize specialized agents (e.g., remediation agents) to systematically address technical debt rather than relying solely on human bandwidth.
- Establish a centralized governance framework that mandates the use of independent verification tools, regardless of which AI model generated the code.

## Topics

AI Development, Software Quality Assurance, Build Engineering, Agentic Workflows, Zero Trust Security, LLM Leaderboard, SonarQube

Source: https://www.youtube.com/watch?v=03l29gJXpCE