Delivery Management
How we manage delivery in the age of agents. From human PR review to autonomous delivery pipeline.
Maturity →
You don't have to figure this out alone.
Every level in this matrix has a path. Read the playbooks the teams that have climbed it wrote. Run the assessment with our consultants. Start where you are.
Book an AI Maturity Assessment session with your team.
We walk you through all four perspectives, score where you actually are, and leave you with a 90-day plan to climb in the dimensions that matter most.
Delivery's September story is where governance physically lives.
For most of the year it lived in a policy document and in each tool's settings screen. It now lives in the AI gateway. Kong AI Gateway 2.0 puts many MCP servers behind one route and shows each caller only the tools it may use, with one identity carried across rate limiting, cost attribution and access control. Claude Code added exact-version model pinning, hard model denies and a prompt-ID header so a gateway can group every request behind one user prompt - which is commit-to-prompt lineage for free. Copilot now makes admins pick a default for new features before they switch themselves on. And then LiteLLM's MCP auth bypass landed on the CISA Known Exploited Vulnerabilities list: any bearer token got a fully authorised session. The lesson is not to avoid gateways. It is that the gateway is now the most important box in your delivery path, and it needs an owner, a patch SLA and CVE monitoring like any other critical infrastructure.
Identity reached the merge path too. An agent commit should come from a distinct bot identity with a short-lived GitHub App or OIDC token, never from a developer's account, and GitHub's new proof of presence asks for a fresh re-authentication before token creation or webhook edits - small friction exactly where stolen tokens do their damage. The case for all of this is written in EY's survey of 202 large US companies: 98% have formal AI governance policies, 47% skipped them for urgent deployments, and 26% cannot detect unauthorised agents. A policy the fast path can skip is not a control. The fix is not a stricter document, it is making the urgent path run through the same gateway as every other path.
Metrics got two corrections. Meta dropped AI usage from engineer performance reviews and scrapped a token leaderboard covering 85,000 employees - last month's anti-pattern, confirmed at the largest scale available. And cost per iteration needs a new denominator. Gemini 3.8 Flash kept its token price, yet cost per task rose from $0.40 to $0.58 because it takes more steps, and Anthropic's own data has Claude working 3.3x longer per prompt than in March. Price per token tells you what the vendor charges. Cost per task tells you what you pay. Meanwhile CircleCI's numbers across 28M workflows show main-branch success at a five-year low of 70.8% while throughput rose 59%, which is the argument for moving verification before the PR opens and letting CI check evidence instead of re-running everything.