AIHA Office Agentic AI & Hyperautomation Implementation Office · demo

Delivery

Methodology, SDLC & gates

Seven phases from discover to retire with activities, deliverables, gates and roles, and the secure AI software development life cycle (AI-SDLC / LLMOps): requirements and prompts as code, threat modelling, continuous evaluation, environments, CAB release control and traceability.

Phases

  • Discover (G0 → G1): Problem framing, process mining, baseline KPIs (rBMS), data availability, risk tier, DPIA screening
  • Design (G1): Architecture pattern, deployment model, autonomy level, HITL design, guardrails, tool scopes, evaluation plan
  • Build (—): Agents, prompts as code, tools via MCP, validators, RAG ingestion, CI with unit and validator tests
  • Evaluate (G2): Evaluation set ≥ 200 cases, grounding, critic agreement, red team, prompt-injection tests, bias tests, independent validation (tier 3–4)
  • Release (G3 / CAB): CAB approval, canary or shadow mode, rollback tested, run-book, HITL staffing, training
  • Run & improve (G4): Monitoring, incidents, FinOps, CSAT/NPS/CES, retraining from HITL feedback, benefits tracking
  • Retire (G4): Decommission agents and bots, revoke identities and keys, archive logs per retention, update registries

AI-SDLC

  • Requirements as code: User stories plus acceptance criteria, risk tier, data classes and HITL rules stored with the agent.
  • Prompts, policies and tools as code: System prompts, guardrail rules, tool scopes and ABAC policies in Git, reviewed by pull request.
  • Secure SDLC: Threat model (STRIDE + OWASP LLM Top 10), secrets scanning, SAST/DAST, dependency and model supply-chain checks, SBOM, signed images.
  • Continuous evaluation (LLMOps): Every change runs the evaluation set; regression beyond tolerance blocks the merge.
  • Environments: dev → test (synthetic data) → pre-prod (shadow on real traffic, no actions) → prod; promotion through Argo CD.
  • Release control: CAB approval for model, prompt, tool or adapter changes; canary 5–10%; automatic rollback on KPI or guardrail alerts.
  • Traceability: Requirement → design → test → evaluation → release → incident, linked in one record for audit and V&V.

Public demo with fictional data (Example Group). © 2025–2026 Russo-Got Marius Mihail & PIR2-IT. All rights reserved.

AIHA Office

More in this demo