Skip to main content

Agentic SDLC Artifact Templates

All artifacts include owner, version, status, risk_tier, last_reviewed, change_history, and related_ids. Use stable identifiers: OUT, FR, NFR, CON, DEC, TASK, TEST, EVAL, RISK, EVD, and INC.

Product Brief​

# Product Brief: [initiative]
Owner: [name/team] | Version: 1.0 | Status: Draft
## Users and problem
## Evidence and limitations
## Outcomes (OUT-*)
## Non-goals
## Constraints
## Assumptions and confidence
## Success signals
## Decision and approvers

Research and Assumption Records​

# Evidence Report
## Question
## Method and sources
## Findings (SOURCE | USER | ASSUMPTION | INFERENCE)
## Counterevidence and limitations
## Recommendation

# Assumption Register
| ID | Assumption | Impact | Confidence | Owner | Verify by | Expires |

Change / Delta Specification​

# Change: [name]
## Motivation and outcomes
## Current behavior
## ADDED requirements
## MODIFIED requirements
## REMOVED requirements
## Compatibility and migration
## Acceptance evidence
## Rollout and recovery

Agent Behavior Specification​

# Agent Specification: [task class]
## Objective
## Allowed actions
## Prohibited actions
## Tools and data
## Trusted and untrusted context
## Required outputs
## Stop conditions
## Escalation conditions
## Success evidence
## Cost and latency budget

Tool Contract​

id: TOOL-example
version: 1.0.0
classification: read | write | external-side-effect
input_schema: {}
output_schema: {}
authorization: []
idempotency: required | unsupported | conditional
dry_run: true
errors: []
retry_policy: none
cancellation: supported
audit_fields: [actor, task_id, timestamp, input_digest, result_digest]
untrusted_output: true

Permission Policy​

owner: platform-security
version: 1.0.0
default: deny
rules:
  - action: repository.read
    decision: allow
    scope: [workspace]
  - action: repository.write
    decision: allow
    scope: [task.allowed_paths]
  - action: network.access
    decision: approve-once
    scope: [declared_hosts]
  - action: production.deploy
    decision: named-human-approval

Context and Memory Policy​

# Context and Memory Policy
## Sources and trust classes
## Required provenance and freshness
## Prohibited content
## Memory lifetimes and writers
## Retention and deletion
## Invalidation triggers
## Conflict resolution
## Poisoning response

Model Routing Policy​

task_classes:
  low_risk_transformation:
    quality_gate: deterministic
    max_retries: 1
  consequential_change:
    quality_gate: independent_review
    max_retries: 2
fallback: stop-and-escalate
budgets:
  cost_per_task: project-defined
  latency: project-defined

Agent-Executable Task​

# TASK-001: [title]
## Objective and linked requirements
## Preconditions and dependencies
## Required context
## Allowed scope
## Prohibited scope
## Risk tier and authority
## Expected outputs
## Verification commands
## Completion evidence
## Rollback
## Stop and escalation conditions

Evaluation Specification​

id: EVAL-001
owner: team
target: agent-or-feature
datasets: [datasets/golden.jsonl, datasets/adversarial.jsonl]
graders:
  - type: deterministic
  - type: model
  - type: human
repetitions: 3
thresholds: {}
disagreement: human-adjudication
failure_action: block-release
cost_latency_budget: {}

Recommended layout:

eval-spec.yaml
datasets/golden.jsonl
datasets/adversarial.jsonl
graders/
fixtures/tools/
eval-results/

Threat Model and Handoff​

# Threat Model
## Assets, actors, entry points
## Trust boundaries and capabilities
## RISK-* scenarios
## Controls and residual risk
## Security tests/evals

# Handoff Contract
## Task and authority
## Completed work and commit
## Evidence
## Changed interfaces
## Unresolved risks
## Next authorized action

Rollout, Readiness, and Incident​

# Operational Readiness
## Dependencies and capacity
## Dashboards and alerts
## Migration and compatibility
## Feature flag and cohorts
## Promotion, pause, and rollback criteria
## On-call and runbook

# INC-001: [incident]
## Impact and timeline
## Detection and containment
## Evidence preserved
## Contributing intent/design/code/policy gaps
## Corrective spec delta
## TEST/EVAL regressions
## Production verification

Evidence Manifest​

{
  "evidence_id": "EVD-001",
  "spec_version": "sha256:...",
  "decisions": ["DEC-001"],
  "tasks": ["TASK-001"],
  "tests": ["TEST-001"],
  "evals": ["EVAL-001"],
  "reviews": [],
  "artifact_digest": "sha256:...",
  "deployment": {},
  "runtime_verification": {},
  "incidents": []
}

Traceability​

OUT-001 → FR-001/NFR-001 → DEC-001 → TASK-001
→ TEST-001/EVAL-001 → review → deployment → runtime signal
→ INC-001 or validated learning