More than 30,000 developers responded to this year’s Stack Overflow survey: 83% use AI in their daily work, yet only 6.6% trust it for critical decisions. In our webinar, "Agents in the Software Lifecycle: From Code to Quality with Method," we shared how Q-Vision builds the architecture that bridges this gap—and here, we cross-reference our approach with the latest industry research.

During the webinar, Verónica Bravo, our Head of Innovation, opened with a scenario every engineering team recognizes: everyone is coding with AI, yet almost no one feels confident about the output. Recent data confirms this reality. The Stack Overflow survey, published on October 6, found that 83% of developers use at least one AI tool at work, and 73% of those using coding assistants or agents rely on them every day. Despite this adoption, 48% say they trust the output only when they can easily verify it, and just 6.6% trust it enough to make critical decisions. Google Cloud’s 2025 DORA report, surveying nearly 5,000 professionals, measured a similar divide: 90% use AI on the job, while 30% have little or no trust in the code it generates.

What developers actually do reveals even more than what they report. 76.5% run AI-generated code locally, 63.9% cross-check it against existing codebases, 53% inspect tests and security implications, and only 9.6% deploy it as-is. They verify because the output looks convincing on the surface—and that exact plausibility is what makes it so difficult to review.

Verónica shared how we experienced this firsthand internally. We build software constantly—both for clients and for our own products—so we started working with large language models as soon as access became available. At first, we did what nearly everyone else did: asking the model in plain natural language for what we wanted, a practice known as vibe coding. For rapid prototyping, it works wonders. When taking it into production applications, however, the cracks began to show. The code compiled and superficially did what we asked, yet it failed under the hood: mishandling edge cases, hallucinating a function, calling a non-existent library, or forgetting to validate an input.

The phrase that best captures this reality is that AI-generated code is plausible by design, not correct by design. The model is trained to predict the most statistically probable token sequence, producing code that looks like what typically appears in a given context. At no point does it reason against a formal specification, execute the logic, or test it. Plausibility comes out of the box; correctness has to be engineered through explicit specifications, automated testing, and validation.

There is also a second perceptual trap that misleads engineering teams. In METR's 2025 study, sixteen experienced developers actually took 19% longer to complete tasks when using AI tools, yet upon finishing, they perceived themselves as having been 20% faster. That is precisely why our methodology measures end-to-end cycle time: writing, reviewing, and fixing.

Published in 2023, the ISO/IEC 42001 standard is the first certifiable framework for AI management systems—and in Colombia, organizations have been able to pursue certification since September 2025. Verónica sums up the sequence we follow: control first, and only then the autonomy to delegate.

Our factory workflow follows four stages that any software team will recognize: a requirement enters, and tested software comes out. First, context is understood and planned, converting the specification into discrete tasks. Next, the code is developed, reviewed, and optimized. Third, quality agents generate automated test cases, execute them, measure coverage, and detect risks. Finally, the software is delivered with validated quality, prepared deployment, and human sign-off at critical checkpoints. What sets this apart is that agents—up to thirteen within a single workflow—operate throughout the entire pipeline, and testing is no longer left at the end as a separate phase; every single improvement passes through it.

On the development side, there is a technical hurdle that took real effort to solve. Even with massive context windows, a single agent still cannot encompass an entire project. We orchestrate the work using graphs: the task is broken down into discrete steps that pass curated context between one another, with validation gates in between. The Stack Overflow survey helps explain why this is necessary: only 16% of developers say AI handles complex tasks very well, while 39% rate it as good, not great.

What the survey also demonstrates is that quality assurance is not disappearing. 58% of developers already use AI to write or improve tests, and 35% expect to use it even more. Verónica was skeptical from the very beginning of the idea that testing would stop mattering. The more code is generated, the more rigorous verification becomes. What changes is how it gets done: quality agents working directly alongside the people who govern and validate the outcomes.

What do you do when someone bypasses the methodology or uses unapproved tools? Verónica answered that without governance, there can be no autonomy—and simply banning a tool is far less effective than it seems. Our solution was to centralize the agents. The factory, with its thirteen orchestrated agents, is shared across the entire organization: the company provides the license for the approved platform, and anyone who picks up a requirement finds the harness—defining exactly how that product is built—already embedded in their workflow.

How do you validate that an agent’s security recommendations are accurate? Through continuous monitoring of everything entering and leaving the system. Dedicated telemetry tools capture execution traces for every agent, showing what inputs it received, what validations it performed, and what decisions it made as a result. On top of that sits an AI gateway equipped with guardrails that verifies whether data is cleared to leave the organization before any request is sent to an external provider.

If the same ecosystem of agents plans, writes code, and tests, how do you guarantee quality independence? That was the sharpest question of the session. Verónica’s answer has two parts. First, in a well-architected factory, a single model does not do everything, nor do the agents share the exact same underlying model. Second, validation gates do not have to be AI agents at all—they can be deterministic scripts and automated processes that evaluate outputs without artificial intelligence, and every agent carries its own deterministic checks. An agent validated solely by another agent risks falling into a loop of mutual self-reinforcement.

Research strongly supports this caution. A paper presented at NeurIPS 2024 by Arjun Panickssery, Samuel Bowman, and Shi Feng demonstrated that models evaluating text recognize their own generated outputs and systematically favor them. A subsequent 2025 study found that this harmful self-preference persists even when the evaluator model is objectively wrong—and that stronger models exhibit this bias even more intensely when they make mistakes.