Marco Scata

Non-determinism matters: if your AI‑assisted test generator produces 100 tests one run and 103 the next, coverage metrics become meaningless. Pin your randomness. #ProofDrivenDeliveries #CompliantDeliveries

Training AI on proprietary code? Prove you have the rights. Evidence of licensing for training data matters more than you think until you're in litigation. #ProofDrivenDeliveries #CompliantDeliveries

AI as requirements analyst: can extract from emails, but can it capture nuance? Missing a "shall" vs "should" creates evidence gaps. Human review essential. #ProofDrivenDeliveries #CompliantDeliveries

The "human in the loop" must be competent, not just present. Someone who understands requirements, risk, evidence standards. Rubber‑stamp reviews are non‑compliant. #ProofDrivenDeliveries #CompliantDeliveries

AI-generated architecture diagrams: pretty but possibly wrong. Must be validated against actual implementation. Evidence includes both the AI output and the human sign-off. #ProofDrivenDeliveries #CompliantDeliveries

Chain of evidence: Prompt → AI output → Human edits → Approval. Each step timestamped, versioned, authored. Incomplete chain = incomplete compliance. #ProofDrivenDeliveries #CompliantDeliveries

AI tools that modify traceability matrices can introduce subtle errors. Human verification of links required. Automation plus validation, not automation instead of. #ProofDrivenDeliveries #CompliantDeliveries

Governance: define which roles can use which AI tools for which artifacts. Unauthorized use creates compliance gaps you cannot defend. #ProofDrivenDeliveries #CompliantDeliveries

AI in code reviews: finds patterns, but does it understand intent? Human judgment about design quality and requirement satisfaction cannot be outsourced. #ProofDrivenDeliveries #CompliantDeliveries

Model drift: AI tool updated between releases produces different artifact styles. That affects reproducibility. Lock your AI models as you lock your dependencies. #ProofDrivenDeliveries #CompliantDeliveries

Evidence of AI use: be specific. "AI‑assisted code completion" vs "ChatGPT wrote this function." Detail matters for auditors assessing tool qualification. #ProofDrivenDeliveries #CompliantDeliveries

Human accountability signature: not just "approved by Jane." Must show Jane understood the artifact, assessed risks, exercised independent judgment. Evidence of engagement. #ProofDrivenDeliveries #CompliantDeliveries

AI-generated test oracles: what does "expected output" mean when AI made it up? Human must derive from requirements, not accept AI's guess. #ProofDrivenDeliveries #CompliantDeliveries

Tool qualification record for your AI assistant: does it meet the standard's rigor? Documentation of validation, limitations, field experience. Treat it like any verification tool. #ProofDrivenDeliveries #CompliantDeliveries

AI can refactor code, but can it maintain evidence links during refactoring? Human must verify traceability survives automated transformations. #ProofDrivenDeliveries #CompliantDeliveries

Prompt engineering as configuration management: prompts that produce compliance artifacts must be version-controlled, reviewed, and baselined. #ProofDrivenDeliveries #CompliantDeliveries

AI-generated security scan rules may create noise or miss real issues. Human tuning and validation required. Evidence must show the tuning decisions and rationale. #ProofDrivenDeliveries #CompliantDeliveries

The guardrail principle: AI accelerates, humans decide. No autonomous compliance artifacts. Every AI contribution carries a human validation signature. #ProofDrivenDeliveries #CompliantDeliveries

Evidence bundle must include: AI tool version, prompt used, raw output, human edits, approver identity, timestamp. Full provenance or it's invalid. #ProofDrivenDeliveries #CompliantDeliveries

AI in requirements elaboration: can flesh out details, but cannot replace domain expert judgment. Ambiguity resolution and acceptance criteria definition stay human. #ProofDrivenDeliveries #CompliantDeliveries