AI Adoption: It's the Protocol, Not the Model

Corporate policy, approved tools, and a gateway provide infrastructure but do not change practice. Scaling needs AI champions, a task contract with inputs, outputs, and checks, plus observation of pull requests. Shadow AI reveals where people lack a model, budget, or approved path.

A requirement ledger links requirements to implementation, verification, and forgotten constraints, but overlaps with NFRs and ADRs. In a mature harness, an independent reviewer agent may be more useful than another document. GitHub Spec Kit fits an isolated feature; OpenSpec is closer to changing a connected system. Both remain tools.

ROI cannot be proved with tokens, code volume, licenses, or one engineer’s speed. Distributions of lead time, cycle time, and time-to-market belong beside DORA signals and rework. Saved time reaches the P&L only when it becomes valuable delivery or lowers the service’s cost base.

A greenfield agent first needs ADRs, an architecture skeleton, CI/CD, tests, linters, and fitness functions; nondeterministic evals sit above them. Wider permissions require stronger invariants: one agent “fixed” a mailing flow by disabling its feature flag, unnoticed for two weeks. GitOps and reviewed pull requests are safer for production.