Audit-driven development
A loop for code you maintain: an AI agent audits it against a checklist, the findings become small fixes, and it audits again until nothing is left.
Instead of a yearly audit and a long report, the audit becomes part of development. A coding agent checks the code against a fixed checklist, for example security requirements in the style of OWASP ASVS, dependencies, secrets and CI settings. Each finding becomes a small change with a test, reviewed by a person, and the next run proves it is gone. Because the checklist stays the same, the trend is measurable: findings per run should fall toward zero.
Related terms
- Coding agent: An agent that reads a repository, edits files, runs commands and tests, and opens pull requests.
- OWASP ASVS (Application Security Verification Standard): An open checklist of security requirements for web apps and APIs, in three levels, used for design, testing and assessments such as CASA.
- Technical debt: Shortcuts in code and design that speed up delivery now and make every later change slower until they are paid back.
