Aug 2026· International journal of computer information systems and industrial management applications· 0 citations
TL;DR
A codepath-aware governance framework for AI-assisted engineering in regulated codebases, with emphasis on financial services, payments, healthcare, and other domains where software changes may affect legal, operational, privacy, and audit obligations is developed.
Abstract
Background: Large language model (LLM)-based coding assistants have moved from experimental developer utilities into everyday software engineering practice. Contemporary studies show that these tools can improve task completion, code comprehension, and routine implementation speed, while also introducing verification costs, usability limits, and security uncertainty. In regulated industries, the relevant question is not only whether AI assistance improves productivity, but whether AI-assisted changes can be governed as part of an auditable control environment. Objective: This article develops a codepath-aware governance framework for AI-assisted engineering in regulated codebases, with emphasis on financial services, payments, healthcare, and other domains where software changes may affect legal, operational, privacy, and audit obligations. Methods: A targeted integrative conceptual review was conducted using recent evidence from 2024-2026 across AI-assisted programming, code-generation security, secure software development, responsible AI governance, and regulated-sector technology risk. Sources were selected for recency, authenticity, publisher quality, regulatory relevance, and direct usefulness for software delivery governance. Results: The synthesis identifies a productivity-compliance asymmetry: AI tools can accelerate code production faster than many organizations can adapt review, provenance, and evidence practices. The article proposes a five-layer governance model comprising regulated scope mapping, AI assistance policy, provenance and accountability, reviewer and control-owner routing, and audit evidence generation. Conclusion: Regulated organizations should avoid both blanket bans and unconstrained adoption. A more defensible approach is controlled acceleration: AI assistance is permitted, but its behavior changes according to the regulatory sensitivity of the codepath being modified. The resulting engineering system should make AI-assisted changes useful, bounded, attributable, reviewable, and auditable.
This state-of-the-art review assembles that evidence across a cross-disciplinary corpus spanning software engineering, human-computer interaction, labour economics, security research, governance, and education, finding the early benchmarks saturated but task-level capability uneven.
D. Michels, Mutaz Abu Ghazaleh, Francois Lazzari et al.· 0 citations
Enterprise software requires specification governance to transform probabilistic AI generation into deterministic, auditable engineering, and the SGRM framework is introduced, which defines four-component specification contracts, constrains stochastic generation via deterministic validation, and integrates generation, verification, and governance into a closed-loop architecture.
Vibe coding is an emerging approach in which developers and non-technical users describe desired functionalities in natural language, delegating actual code generation to an artificial intelligence model. This paper presents a structured case study of vibe coding through a practical experiment, using Visual Studio Code and Anthropic's Claude model to build a functional web application. We document how the vibe coding workflow operates in practice, compare the estimated development time against a conventional manual implementation of the same application, and examine the security posture of the resulting software through a structured audit. While the artificial intelligence (AI) assisted process demonstrated a notable reduction in implementation time - illustrative of a single-user, single-application scenario and not generalizable beyond it - the security audit identified several categories of vulnerabilities in the generated codebase, suggesting that vibe coding may not reliably produce secure software in this case study. The study further identifies inherent risks of this paradigm, including potential exposure of sensitive data and the difficulty of auditing automatically generated code. We also propose a conceptual clarification between vibe coding and agentic coding paradigms. We conclude that vibe coding democratizes access to software development but requires rigorous oversight frameworks to be adopted responsibly.
Mihnea Neferu, Constantin-Viorel Marian, D. Mitrea· European Conference on Artif...· 0 citations
The use of large language models (LLMs) is being introduced into requirements, code generation, testing, maintenance, and documentation processes, but most IT organizations have yet to establish a practical and evidence-based methodology regarding when these tools are value added, when they become risky, and how to regulate their usage. The article is a synthesis of recent empirical research, surveys of developers, and guidance on the use of LLMs in software engineering and translates that information into a playbook of guidance that can be applied by practitioners. The primary contribution of the article is a staged adoption framework, which includes explore, pilot, and scale, supported with lightweight survey templates, small-task assessment designs, and accept/edit/reject logging practices that organizations can adopt to produce their own context-specific evidence. The objective is to facilitate disciplined, open-minded adoption of LLMs in actual software engineering environments.
AI-assisted software development approaches, such as vibe coding, enable rapid code generation but lack the governance and reliability required for sustaining engineering in enterprise software. In these environments, traceability, security, technical debt management, and architectural integrity are critical for any software modification. This paper presents ATeam, a framework that facilitates AI-assisted software development through a structured and auditable maintenance process incorporating human oversight. The framework employs a multi-phase pipeline that enforces impact analysis and explicit approval gates. ATeam is evaluated on 24 sustaining engineering tasks spanning four IEEE maintenance categories, utilizing three distinct large language models (LLMs). A set of interdependent microservices is developed to assess the system. ATeam achieves an 82.5 end-to-end score. The results demonstrate that structured decomposition and governance reduce dependence on model scale, with smaller models remaining competitive with larger ones. This finding enables regulated industries to leverage AI-assisted development using on-premises models. Comparative evaluation against AutoGPT-style and unconstrained baselines reveals that ATeam achieves statistically significant improvements (Welch's $p<10^{-6})$ with large effect sizes. The evidence suggests that governance, rather than agentic execution alone, is the primary determinant of reliable enterprise software sustaining engineering.
Salvatore Vella, Alex Ferworn, Malek Sharieh· 2026 6th International Confe...· 0 citations
The risk is not tied to any particular model but rather to the task category, and organizations should ask not which tool to trust, but instead whether LLM-generated automation code should be deployed without review.
