Specifying AI-SDLC Processes: A Protocol Language for Human-Agent Boundaries
06:00 · June 23, 2026 · arXiv cs.AI RSS
AI agents now participate as first-class team members across the software development lifecycle, yet no specification language exists for expressing the human-agent responsibility boundaries, approval gates, and governance constraints this collaboration requires. Existing approaches encode process in agent prompts (subject to drift), target adjacent domains (workflow management, business processes), or address only fragments (access control, approval gates). We propose a domain-specific language for specifying AI-SDLC processes as protocols, with formal syntax, well-formedness conditions, operational semantics, and enforcement invariants. The language distinguishes policy (declared intent) from mechanism (structural enforcement), enabling implementations to bound process non-determinism through primitives such as validation tokens and capability boundaries. Three results follow. A failure rate analysis shows that structural enforcement bounds system failure rates at a weighted product of agent and validator rates, while behavioral compliance permits cumulative or near-saturating growth. The 2+N team pattern (two human-in-control roles plus N specialized agent members) formalizes classical Separation of Duties for AI-SDLC. Kleene closure of orchestration loops and reflexive protocol-adherence validation emerge as design properties rather than special-case constructs. We position the contribution against multi-agent frameworks (MetaGPT), workflow specification (FlowAgent, BPMN extensions), and capability-based security (SAGA): the novelty lies in the specific integration, not any single primitive. A working implementation demonstrates feasibility; empirical evaluation is future work.
Summary
A domain-specific language now lets teams declare AI-SDLC protocols that explicitly separate human and agent responsibilities, approval gates, and governance constraints. The language supplies formal syntax, well-formedness rules, operational semantics, and enforcement invariants so that process definitions become executable rather than implicit prompts or ad-hoc scripts. By separating declared policy from structural mechanism, implementations can enforce capability boundaries and validation tokens that limit non-determinism at runtime.
Failure-rate analysis shows that structural enforcement produces a weighted product of agent and validator error rates, whereas reliance on behavioural compliance allows cumulative or near-saturating growth in failures. The language therefore encodes the classical separation-of-duties principle as the 2+N team pattern—two human-in-control roles plus any number of specialised agents—turning oversight into a reference configuration rather than an informal expectation. Additional design properties, such as Kleene closure over orchestration loops and reflexive protocol-adherence validation, emerge directly from validator extensibility without requiring special-case constructs.
The approach is positioned against multi-agent frameworks, workflow languages, and capability systems; its contribution lies in the coherent integration of these elements for AI-integrated development rather than in any isolated primitive. A working implementation demonstrates feasibility, while simulation studies examine disagreement policies, governance overhead, and Byzantine robustness. End-to-end evaluation on production software tasks remains future work.
Why it matters
This research is highly relevant for the Dutch AI market due to its strong alignment with EU AI Act requirements for human oversight and governance. By providing a formal language to enforce human-agent boundaries, it offers researchers and enterprises a rigorous method to build compliant, transparent, and safe multi-agent systems.
