AI Coding Tool Rollout and Enablement
Getting a measurable return from AI coding tools. Baseline first, then rollout with the review and security practices adjusted for code a human did not write line by line.
- Who
- Founder holds the engineering leadership seat; the delivery team executes underneath it.
What you're seeing
- Licences were bought for everyone and adoption is reported as seat count.
- Usually means Seats are always high — the licence is free to the engineer and awkward to decline. It says nothing about whether anything shipped faster.
- The only evidence the tools helped is people saying they helped.
- Usually means No baseline was taken, so self-report is all that is available. Self-reported time savings are the metric every vendor quotes and they measure enthusiasm rather than throughput.
- Pull requests got larger after rollout and review got slower.
- Usually means Generated code arrives faster than it can be read carefully. Writing became cheaper and reviewing did not, so the constraint simply moved downstream where nobody is watching it.
- Somebody proposed hiring fewer engineers because of the tooling.
- Usually means The cost of writing code has been confused with the cost of owning it. Ownership — understanding, maintaining, being on call for it — is unchanged, and a large volume of code nobody understands is a liability rather than an asset.
Seats are not adoption
Licence counts are always high. The licence is free to the engineer and declining it is awkward.
What that number does not tell you is whether anything reached production faster, whether the code that arrived was reviewable, or whether the effect was concentrated in two enthusiasts and absent everywhere else. Those are all answerable, and none of them is answered by a seat report or by a survey.
So the first step is a baseline: the delivery metrics as they stand, before any licence is issued. It costs almost nothing because the data already exists, and without it the entire question becomes unanswerable in a way that quietly favours whoever wants the answer to be yes.
Where the tools are strong
The patterns that transfer are specific and they are learnable in an afternoon on your own code.
These tools are consistently good at tests against existing behaviour, at migrations and mechanical refactors, at boilerplate, and at orienting someone in a codebase they have never seen. They are expensive where the problem requires holding a large amount of context that is not in the repository — a decision made two years ago, a constraint from a customer contract, the reason the obvious approach was rejected.
Teaching that distinction on a demonstration project produces a pattern that does not transfer. Teaching it on the actual repository produces one that does, and it also surfaces the parts of your codebase where these tools are actively counterproductive.
The constraint moves to review
Writing gets cheaper. Reviewing does not.
That shift is the most predictable second-order effect of a rollout and it is the one nobody prepares for, because it does not announce itself. It shows up as larger pull requests, longer review latency, and a gradual drift toward approving things that were read quickly rather than read carefully.
Adjusting for it means adapting the review practice — smaller changes enforced, automated scanning weighted more heavily, an explicit expectation that generated code is reviewed at the same depth as written code — before the volume arrives rather than after a quarter of accumulation.
Where it sits
This capability sits under AI Consulting, as the internal half of that page — the other half being model-backed features in the product itself.
It depends on DORA Metrics for the baseline and the verdict, which is what separates this from a licence purchase with a workshop attached. And it leans on Code Security Review, because automated scanning becomes more load-bearing exactly as the proportion of code that was read carefully by a human goes down.
How the work runs
-
Baseline before rolling out
Delivery metrics measured first. Without a baseline the only available evidence afterwards is self-reported time saved, which is not evidence.
-
Establish the working patterns
Where these tools are strong — tests, migrations, boilerplate, unfamiliar codebases — and where they are expensive. Taught with your own code, not with demonstrations.
-
Adjust review and security
Generated code arrives faster than it can be read carefully. Review practice and scanning are adapted before volume increases, not after.
-
Measure again and decide
The same metrics after a quarter, with a real option to conclude the tools did not help for your work.
What arrives
- A delivery baseline taken before rollout
- Working patterns documented against your own codebase
- Review and scanning practice adjusted for generated code
- A measured verdict after a quarter, with the option of stopping
What it costs your team
A baseline setup, a workshop, and around two hours a week from a lead during rollout.
How we decide
The delivery baseline is taken before the licences
Costs It delays a rollout everyone is keen to start, for a measurement nobody is excited about.
Without a baseline, the only evidence available afterwards is self-report, and self-report is the weakest instrument in this whole area. Cycle time, review latency and change failure rate were already being collected for other reasons; capturing them beforehand costs nothing and is the difference between a verdict and an impression.
Patterns are taught on your own codebase, never on demonstrations
Costs It takes preparation time and it produces less impressive sessions.
Where these tools are strong and where they are expensive depends heavily on the code. A demonstration on a clean toy project teaches a pattern that does not transfer, and it sets an expectation that the first real attempt then contradicts. Working on the actual repository finds the real answer in an afternoon.
Review and scanning are adjusted before volume rises, not after
Costs It is work done in anticipation of a problem that has not appeared yet.
Writing gets cheaper and reviewing does not, so the constraint moves to review — and it moves quietly, showing up as larger pull requests and longer latency rather than as an incident. Adapting review practice and automated scanning first is considerably cheaper than discovering the backlog after a quarter of accumulation.
The verdict after a quarter includes the option of stopping
Costs It sets up a conclusion that may embarrass whoever championed the rollout.
Rollouts without a stopping condition do not end; they become permanent regardless of what the numbers say, because unwinding one is read as an admission. Naming the measurement point and the option in advance is what makes the exercise an experiment rather than a purchase being justified.
Where this has run
Frequently Asked Questions
Sources
- DORA — the four key metricsdora.dev
- DORA — State of DevOps reportdora.dev
- Anthropic — documentationdocs.anthropic.com
- OWASP — Top 10 for LLM Applicationsowasp.org
Page reviewed
