Matrix/Delivery Management

Delivery Management

How we manage delivery in the age of agents. From human PR review to autonomous delivery pipeline.

4capabilities20levels60practices60guides
The matrix · full map
Capability ↓
Maturity →
L1 · Stage 01
Assisted
L2 · Stage 02
Delegated
L3 · Stage 03
Systematic
L4 · Stage 04
Governed
Sweet spot
L5 · Stage 05
Self-improving
01·15 guides
CI/CD Pipeline
Speed and reliability of your build-test-feedback loop for AI-generated code
CI runs; everyone waits
3 practices·3 guides
Ten minutes, runners per team
3 practices·3 guides
Five minutes, a pipeline per worktree
3 practices·3 guides
Two minutes in an isolated microVM
3 practices·3 guides
Feedback in seconds, capacity on demand
3 practices·3 guides
02·15 guides
Merge & Deploy
How PRs flow from creation to production - throughput, automation, and conflict handling
Every merge has a human in it
3 practices·3 guides
A queue does the rebasing
3 practices·3 guides
Policy decides what merges, and when
3 practices·3 guides
Green auto-merges straight to production
3 practices·3 guides
A thousand merges a week, agent-driven
3 practices·3 guides
03·15 guides
Metrics
What you measure to understand AI-assisted engineering productivity and quality
DORA at best; AI still unmeasured
3 practices·3 guides
Token spend is finally on a dashboard
3 practices·3 guides
You know your cost per merged PR
3 practices·3 guides
Every agent run ends in a known state
4 practices·4 guides
Cost per feature, value per token
2 practices·2 guides
04·15 guides
Governance & Compliance
Controls around AI-generated code - licensing, security scanning, and audit trails
Personal subscriptions, no policy
3 practices·3 guides
A policy exists and spend has caps
3 practices·3 guides
Every agent action leaves a trail
3 practices·3 guides
Provenance is cryptographic, checks automated
3 practices·3 guides
Compliance watches the regulators for you
3 practices·3 guides
Climb the matrix

You don't have to figure this out alone.

Every level in this matrix has a path. Read the playbooks the teams that have climbed it wrote. Run the assessment with our consultants. Start where you are.

Live with Visdom

Book an AI Maturity Assessment session with your team.

We walk you through all four perspectives, score where you actually are, and leave you with a 90-day plan to climb in the dimensions that matter most.

Book an assessment See what's included90-day plan - scored assessment - coaching
Author Commentary

If the factory has an operating manual, delivery is where you find out whether anyone is reading it.

Two numbers from August frame the whole perspective. The first is Zalando's: 33% of pull requests auto-approved by a risk classifier trained on their own incident history, with a 20-40% reduction in lead time - a genuine result from a genuine platform. The second is LinearB's, across 8.1M PRs: agentic PRs merge at 79% in elite organisations and 37% in the rest, and the variable that separates them is not tooling. It is ownership. An agent-opened PR with no named human owner does not get rejected; it just quietly never merges. Throughput is a queueing problem long before it is a model problem.

The bill arrived too, and it is itemised in three places. A study of 3.52M changes in one enterprise C++ codebase found AI-generated code carries higher coupling and copy overhead that shows up as a 5-8% increase in production compute consumption - the first credible number putting AI code on the cloud bill rather than the maintainability ledger. Meta's internal telemetry, reported by Reuters, shows changes to internal platforms up 220% and features up 36%, against major incidents up 40% and time firefighting them up 70%. And McKinsey's survey of 1,719 leaders has EBIT impact statistically flat year over year at 37% any, 6% significant. The productivity is real; so is the counterweight, and any metrics program that reports only the first half is not measuring, it is marketing. Track incidents-per-merged-change next to throughput or do not bother.

Governance is where August moved fastest, and mostly in one direction: away from scanning and toward provenance. Rust adopted an explicit LLM policy - analyse, review, refine, but do not create - Oracle barred AI-generated code from OpenJDK, Debian voted, SourceHut changed its terms. The Linux kernel's 7.2 cycle carried 1,111 `Assisted-by` commits, and at least one maintainer strips the tags on the way in, which tells you everything about disclosure that is not enforced in CI. One factual correction worth carrying: the EU AI Act milestone that actually bit on 2 August 2026 was Article 50 transparency, not the high-risk regime. The Digital Omnibus deferred that to December 2027 and August 2028. Plan the conformance work, but do not let anyone sell you a panic about a deadline that moved.

Other perspectives