Aug 2026· International journal of computer information systems and industrial management applications· 0 citations
TL;DR
A codepath-aware governance framework for AI-assisted engineering in regulated codebases, with emphasis on financial services, payments, healthcare, and other domains where software changes may affect legal, operational, privacy, and audit obligations is developed.
Abstract
Background: Large language model (LLM)-based coding assistants have moved from experimental developer utilities into everyday software engineering practice. Contemporary studies show that these tools can improve task completion, code comprehension, and routine implementation speed, while also introducing verification costs, usability limits, and security uncertainty. In regulated industries, the relevant question is not only whether AI assistance improves productivity, but whether AI-assisted changes can be governed as part of an auditable control environment. Objective: This article develops a codepath-aware governance framework for AI-assisted engineering in regulated codebases, with emphasis on financial services, payments, healthcare, and other domains where software changes may affect legal, operational, privacy, and audit obligations. Methods: A targeted integrative conceptual review was conducted using recent evidence from 2024-2026 across AI-assisted programming, code-generation security, secure software development, responsible AI governance, and regulated-sector technology risk. Sources were selected for recency, authenticity, publisher quality, regulatory relevance, and direct usefulness for software delivery governance. Results: The synthesis identifies a productivity-compliance asymmetry: AI tools can accelerate code production faster than many organizations can adapt review, provenance, and evidence practices. The article proposes a five-layer governance model comprising regulated scope mapping, AI assistance policy, provenance and accountability, reviewer and control-owner routing, and audit evidence generation. Conclusion: Regulated organizations should avoid both blanket bans and unconstrained adoption. A more defensible approach is controlled acceleration: AI assistance is permitted, but its behavior changes according to the regulatory sensitivity of the codepath being modified. The resulting engineering system should make AI-assisted changes useful, bounded, attributable, reviewable, and auditable.
Vibe coding - AI-assisted software development in which the developer describes intent in natural language and validates results by running rather than reading the generated code - was named by Andrej Karpathy in February 2025 and produced its first body of empirical evidence within seventeen months. This state-of-the-art review assembles that evidence across a cross-disciplinary corpus spanning software engineering, human-computer interaction, labour economics, security research, governance, and education. We survey the model landscape, the tool ecosystem, and the performance record by task type, finding the early benchmarks saturated but task-level capability uneven: reliable code generation alongside weak fault detection and hard-to-audit documentation. The productivity record is at first contradictory: peer-reviewed field experiments report +26% more tasks per week, independent randomised trials measure a 19% slowdown, and team-level telemetry shows code-review time up +441%. We argue these readings are consistent once measurement method, scope, and time horizon are held constant, and identify six patterns behind the dispersion, among them effect-shrinkage under broader measurement, self-report diverging from independent measurement, output volume conflated with productivity, and bold claims walked back once tested over longer horizons. We further document security failures in deployed applications, code-quality degradation visible in large-scale code and developer telemetry, unsettled copyright exposure, and evidence of skill atrophy. The review closes with the open research questions and one falsifiable conjecture: that the gains are real on new code and shrink or reverse on mature codebases, which would account for most of the disagreement in the record.
D. Michels, Mutaz Abu Ghazaleh, Francois Lazzari et al.· 0 citations
Enterprise software requires specification governance to transform probabilistic AI generation into deterministic, auditable engineering, and the SGRM framework is introduced, which defines four-component specification contracts, constrains stochastic generation via deterministic validation, and integrates generation, verification, and governance into a closed-loop architecture.
Vibe coding is an emerging approach in which developers and non-technical users describe desired functionalities in natural language, delegating actual code generation to an artificial intelligence model. This paper presents a structured case study of vibe coding through a practical experiment, using Visual Studio Code and Anthropic's Claude model to build a functional web application. We document how the vibe coding workflow operates in practice, compare the estimated development time against a conventional manual implementation of the same application, and examine the security posture of the resulting software through a structured audit. While the artificial intelligence (AI) assisted process demonstrated a notable reduction in implementation time - illustrative of a single-user, single-application scenario and not generalizable beyond it - the security audit identified several categories of vulnerabilities in the generated codebase, suggesting that vibe coding may not reliably produce secure software in this case study. The study further identifies inherent risks of this paradigm, including potential exposure of sensitive data and the difficulty of auditing automatically generated code. We also propose a conceptual clarification between vibe coding and agentic coding paradigms. We conclude that vibe coding democratizes access to software development but requires rigorous oversight frameworks to be adopted responsibly.
Mihnea Neferu, Constantin-Viorel Marian, D. Mitrea· European Conference on Artif...· 0 citations
The use of large language models (LLMs) is being introduced into requirements, code generation, testing, maintenance, and documentation processes, but most IT organizations have yet to establish a practical and evidence-based methodology regarding when these tools are value added, when they become risky, and how to regulate their usage. The article is a synthesis of recent empirical research, surveys of developers, and guidance on the use of LLMs in software engineering and translates that information into a playbook of guidance that can be applied by practitioners. The primary contribution of the article is a staged adoption framework, which includes explore, pilot, and scale, supported with lightweight survey templates, small-task assessment designs, and accept/edit/reject logging practices that organizations can adopt to produce their own context-specific evidence. The objective is to facilitate disciplined, open-minded adoption of LLMs in actual software engineering environments.
AI-assisted software development approaches, such as vibe coding, enable rapid code generation but lack the governance and reliability required for sustaining engineering in enterprise software. In these environments, traceability, security, technical debt management, and architectural integrity are critical for any software modification. This paper presents ATeam, a framework that facilitates AI-assisted software development through a structured and auditable maintenance process incorporating human oversight. The framework employs a multi-phase pipeline that enforces impact analysis and explicit approval gates. ATeam is evaluated on 24 sustaining engineering tasks spanning four IEEE maintenance categories, utilizing three distinct large language models (LLMs). A set of interdependent microservices is developed to assess the system. ATeam achieves an 82.5 end-to-end score. The results demonstrate that structured decomposition and governance reduce dependence on model scale, with smaller models remaining competitive with larger ones. This finding enables regulated industries to leverage AI-assisted development using on-premises models. Comparative evaluation against AutoGPT-style and unconstrained baselines reveals that ATeam achieves statistically significant improvements (Welch's $p<10^{-6})$ with large effect sizes. The evidence suggests that governance, rather than agentic execution alone, is the primary determinant of reliable enterprise software sustaining engineering.
Salvatore Vella, Alex Ferworn, Malek Sharieh· 2026 6th International Confe...· 0 citations
LLM-based coding tools enable non-expert users to generate routine automation scripts that may enter enterprise workflows without meaningful security review. This study examines that risk directly. Code was collected from ChatGPT, Microsoft Copilot, and Google Gemini using identical prompts across three automation domains. Claude Code performed a standardized vulnerability review. Each identified vulnerability was scored using CVSS v3.1 and mapped to the OWASP Top 10:2021 and the MITRE ATT&CK frameworks. Every script contained exploitable vulnerabilities. Nine of the 17 identified vulnerability classes appeared in code from all three models, while 14 of the 17 vulnerability classes appeared in at least two models. The weighted CVSS scores across platforms differed by less than 10%. The risk is not tied to any particular model but rather to the task category. Organizations should therefore ask not which tool to trust, but instead whether LLM-generated automation code should be deployed without review.