The agent development lifecycle (ADLC) is the end-to-end process for taking an AI agent from idea to governed production and keeping it reliable: frame the use case and autonomy level, design tools and permissions, build, evaluate on realistic tasks, approve through a risk review, deploy in stages, operate with tracing and cost controls, and improve continuously. It extends the familiar software development lifecycle because agents behave probabilistically, choose their own steps and can act on business systems. That makes evaluation, approval gates and production monitoring first-class phases rather than afterthoughts. This guide describes each phase, its outputs and the governance that ties them together.
Key takeaways
- Decide the agent’s autonomy level at the start. It determines the controls, testing depth and approvals needed.
- Evaluation is continuous: a task-level test suite runs on every change to prompts, tools or models.
- Release through an explicit approval gate with security, risk and business sign-off.
- Deploy in stages, such as shadow mode, then human-approved actions, then limited autonomy.
- Operate with tracing, cost per task and quality metrics, and feed findings back into the next iteration.
Why AI agents need their own development lifecycle
| Aspect | Traditional SDLC | Agent development lifecycle |
|---|---|---|
| Behaviour | Deterministic: same input, same output | Probabilistic: outputs and chosen steps can vary |
| Testing | Unit and integration tests with exact expected results | Task-level evaluation with graded outcomes, plus adversarial tests |
| Change surface | Code | Code, prompts, tools, models, retrieved data and memory |
| Release gate | Tests pass, change approved | Evaluation thresholds met, risk review and autonomy level approved |
| Production | Errors and performance monitoring | Also tracing of reasoning and tool calls, quality drift and cost per task |
The ADLC does not replace your SDLC; it adds the agent-specific phases and controls on top. For the coding side of delivery, see our AI-assisted software development lifecycle.
The eight phases of the agent development lifecycle
1. Frame
Define the task, the measurable outcome, the users and the risk. Decide the target autonomy level and what the agent must never do. Check readiness with our AI agent readiness checklist.
2. Design
Specify the tools the agent may call, the permissions for each, memory and retrieval needs, approval points and failure handling. Choose an orchestration pattern; a single agent is usually the right start. See multi-agent orchestration patterns.
3. Build
Implement prompts, tools, orchestration and the user experience in short iterations. Expose business systems through well-defined tool interfaces, often with the Model Context Protocol. See building a secure MCP server.
4. Evaluate
Run a task suite of realistic cases with expected outcomes, including edge cases and adversarial inputs such as prompt injection. Track task success, tool errors, unsafe actions, latency and cost per task. Evaluation runs on every change, not only before launch.
5. Approve
A release gate where security, risk, compliance and the business owner review evaluation results, the threat model and the requested autonomy level, then sign off. The NIST AI Risk Management Framework and ISO/IEC 42001 provide structures for this review.
6. Deploy
Release in stages behind feature flags: shadow mode, where the agent proposes but does not act; then actions with human approval; then limited autonomy for proven low-risk steps.
7. Operate
Trace every run, monitor quality, failures and cost per task, and alert on anomalies. See AI agent observability.
8. Improve
Use traces, user feedback and reviewer corrections to update prompts, tools and the evaluation suite. Re-enter evaluation and approval for significant changes, such as new tools or a higher autonomy level.
Agent autonomy levels
Moving up a level is a deliberate decision made through the approval gate, backed by evaluation evidence from the level below. Many business agents deliver most of their value at levels 1 and 2. For approval design, see human-in-the-loop AI agents.
Outputs and owners by ADLC phase
| Phase | Key outputs | Typical owner |
|---|---|---|
| Frame | Use case brief, success measures, risk tier, target autonomy | Business product owner |
| Design | Tool catalogue, permission model, approval points, threat model | Solution architect, security |
| Build | Versioned prompts, tools, orchestration, UI | Engineering team |
| Evaluate | Task suite, evaluation report, red-team findings | Engineering and QA, domain experts |
| Approve | Signed release decision with conditions | Risk, security, business owner |
| Deploy | Rollout plan, feature flags, rollback procedure | Platform and DevOps |
| Operate | Dashboards, alerts, incident runbook, cost reports | Operations and product owner |
| Improve | Change backlog, updated test cases | Product owner and engineering |
Governance across the lifecycle
- Version everything. Prompts, tool definitions, model versions and evaluation sets are versioned together so any result can be reproduced.
- Least privilege. Each tool has the narrowest permissions possible. See AI agent security threats.
- Guardrails. Input and output policies enforced at runtime. See LLM guardrails.
- Audit trail. Every decision, tool call and approval is recorded.
- Kill switch. Operators can pause the agent or drop it to a lower autonomy level instantly.
- Regular review. The approval body reviews production metrics and incidents on a schedule.
Getting started with the ADLC
Apply the full lifecycle to one agent first, with lightweight templates for each phase. Keep the first release at autonomy level 1 or 2, prove it with metrics, then reuse the templates, evaluation tooling and approval process for the next agent. Budget for the evaluation and governance phases from the start; we break the numbers down in AI agent development cost.
Common questions
What is the agent development lifecycle (ADLC)?
It is the end-to-end process for building and running AI agents: frame, design, build, evaluate, approve, deploy, operate and improve, with governance and continuous evaluation throughout.
How is the ADLC different from the SDLC?
Agents are probabilistic, choose their own steps and act on systems, so the ADLC adds task-level evaluation, explicit autonomy levels, risk approval gates and production tracing of reasoning, tool use and cost.
When should an agent move to a higher autonomy level?
Only when evaluation and production evidence at the current level show it is reliable for the specific steps involved, and the approval gate signs off.
How often should agents be re-evaluated?
On every change to prompts, tools, models or retrieved data, and on a regular schedule in production to detect drift.
Who should approve an agent for production?
The business owner together with security and risk or compliance representatives, based on evaluation results, the threat model and the requested autonomy level.
Put a governed lifecycle around your AI agents
Whether you are building your first agent or scaling several, our generative AI development and project management teams can set up the ADLC templates, evaluation tooling and approval process with you.