A three-tier oversight system for agentic code generation can preserve about 91% of coding speed while producing the compliance artifacts required by major regulators; the GAIE framework maps task-level oversight to regulatory impact to balance productivity and auditability.

Main Finding

GAIE (Governed AI-Assisted Engineering) proposes a three‑tier, risk‑calibrated human‑oversight framework for agentic code generation in regulated domains. Using a formal Oversight Classification Model (OCM) that classifies tasks on four risk dimensions, GAIE routes generation tasks to Human‑in‑the‑Loop (Tier 1), Human‑over‑the‑Loop (Tier 2), or Automated‑with‑Monitoring (Tier 3) workflows and produces per‑tier evidence artifacts for auditability. Analytical evaluation indicates graduated oversight preserves most agentic coding velocity (central estimate ~91%, range 84–97%) while meeting regulatory evidence requirements.

Key Points

• Problem addressed: uniform review policies either collapse agentic coding velocity (“review everything”) or risk non‑compliance (“review nothing”). GAIE applies graduated oversight proportional to regulatory impact.
• Oversight Classification Model (OCM):
  • Deterministic mapping OCM : T → {Tier1, Tier2, Tier3}.
  • Task feature vector φ(t) = (RI, CP, RV, DS): Regulatory Impact, Customer Proximity, Reversibility, Data Sensitivity.
  • Decision rules (including fail‑safe thresholds and dependency graph checks) route tasks to tiers.
  • Formal properties proven: monotonicity (higher risk → no lower tier), fail‑safe under uncertainty, totality (every task assigned).
• Three oversight tiers:
  • Tier 1 — Human‑in‑the‑Loop (HITL): for strategic/regulatory critical tasks. Agent pauses; human approves before generation and before deploy. Strongest evidence artifacts (signed approvals, reviewer IDs, rationale).
  • Tier 2 — Human‑over‑the‑Loop (HOTL): for customer‑impacting or sensitive/irreversible indirect tasks. Agent generates/tests; human approves deployment. Moderate artifact requirements.
  • Tier 3 — Automated‑with‑Monitoring (AWM): for low‑risk internal tasks. Autonomous pipeline with post‑deploy monitoring and exception escalation. Lightweight artifacts but continuous baselining and anomaly detection.
• Evidence‑by‑design: GAIE requires cryptographically linked, append‑only evidence chains (classification logs, generation traces, tests, scans, approvals, monitoring records) to enable auditability without separate workstreams.
• Cross‑jurisdiction mapping: GAIE mapped to Bank of Thailand (2025) requirements and shown applicable to MAS FEAT, NIST AI RMF, ISO/IEC 42001, EU AI Act—intended as implementable traceability from framework elements to supervisory controls.
• Threat model and mitigations: classification evasion, evidence tampering, governance fatigue, registry staleness. Mitigations include dependency analysis, confidence thresholds, cryptographic stores, review metrics, and periodic registry updates.
• Running example: illustrative regulated bank tasks classified across tiers (credit decision changes → Tier1; UI updates → Tier2; internal CI changes → Tier3).
• Evaluation: multi‑method — regulatory coverage analysis, comparative framework analysis, and analytical productivity modeling with sensitivity analysis (producing the 84–97% velocity preservation estimate).

Data & Methods

• Nature of work: conceptual framework + formal model + analytical evaluation; not an empirical randomized trial.
• Formal model:
  • OCM defined as total deterministic function; task features φ(t) capture four discrete dimensions (RI, CP, RV, DS).
  • Algorithmic decision tree and pseudocode provided. Theorems with proof sketches: monotonicity, fail‑safety, totality.
• Evidence model: design of cryptographically linked artifact chain (hash‑chaining append‑only store).
• Supporting controls: data boundary enforcement (PII detection), prompt/output safety (OWASP LLM Top 10 / MITRE ATLAS patterns), immutable provenance.
• Evaluation methods:
  • Regulatory coverage analysis: traceability mapping GAIE elements to specific supervisory expectations in BOT, MAS, NIST, ISO/IEC 42001, EU AI Act.
  • Comparative framework analysis: contrasted GAIE against existing maturity/governance models (ACMM, SAE, prior HITL proposals).
  • Analytical productivity modeling: an analytical model estimating net coding velocity given agent generation speed, tier frequencies, per‑tier human review overheads, and fail‑safe escalation probabilities. Sensitivity analysis over parameter ranges yields preserved velocity central estimate 91% (range 84–97%).
• Data used: illustrative bank scenario, literature estimates of agentic coding productivity/telemetry (cited studies showing 20–56% gains or mixed effects), and assumptions encoded in the analytical model (review times, frequencies of strategic tasks, classification uncertainty). No new field experiment data reported.

Implications for AI Economics

• Productivity vs. Compliance tradeoff: GAIE quantifies a governance strategy that largely preserves agentic coding productivity while producing regulatory evidence. The reported central estimate (~91% of velocity preserved) suggests firms can capture most automation gains without wholesale sacrifice to compliance, altering cost–benefit calculations for adopting agentic systems in regulated sectors.
• Reallocation of labor and skill demand:
  • Shift from routine coding to oversight, review, and evidence evaluation roles (higher emphasis on reviewer/validator tasks).
  • Potential increase in demand for compliance engineers, regulatory product managers, and tooling that automates evidence capture.
• Compliance cost structure:
  • Upfront cost to implement OCM, immutable evidence stores, monitoring and security controls.
  • Ongoing oversight costs concentrated on Tier 1/2 tasks; GAIE reduces total human review hours compared with “review everything” approaches, lowering marginal compliance costs per generated artifact.
  • Fail‑safe escalation and conservative defaults under uncertain metadata can increase human oversight for ambiguous tasks — this imposes a prudence premium that regulators may accept in exchange for auditability.
• Risk management and regulatory capital effects:
  • Better auditability and traceability reduce regulatory risk and potential fines/operational loss from non‑compliance, which may decrease the regulatory capital premium for firms able to credibly demonstrate governance.
  • Firms that can operationalize GAIE may face lower supervisory friction when deploying agentic coding in customer‑facing functions.
• Market and competition effects:
  • Vendors offering integrated governance layers (OCM + evidence chains + monitoring) become valuable; a new market for "governance middleware" and compliance‑as‑feature is likely.
  • Cross‑jurisdiction applicability increases economies of scale for governance tooling, reducing per‑jurisdiction adaptation costs.
  • Potential for regulatory arbitrage is reduced if GAIE is widely adopted and mapped to major frameworks; conversely, differences in threshold settings or definitions of "strategic" may create local variability in adoption costs.
• Innovation velocity and investment:
  • By preserving most automation speedups while meeting regulatory constraints, GAIE lowers the effective barrier to invest in agentic development for regulated firms, potentially increasing R&D and product rollout rates.
  • However, initial implementation and auditability infrastructure create fixed costs that favor larger incumbents or cloud/DevOps providers, possibly increasing concentration in platform markets.
• Areas for further economic analysis:
  • Empirical measurement of GAIE in production: realized velocity, defect rates, oversight staffing levels, and net cost per feature deployment.
  • Welfare analysis: effects on consumer outcomes (e.g., faster product updates vs. potential residual errors), and systemic risk from misclassification or governance fatigue.
  • Optimal thresholding: calibrating OCM confidence thresholds to minimize expected total cost (human oversight cost + expected regulatory penalty from misclassification).

Limitations noted in the paper (relevant to economic assessment): GAIE governs the development pipeline but does not replace model risk management, enterprise cybersecurity review, nor SDLC controls; outcomes depend on metadata quality and registry accuracy; quantitative productivity estimates are analytical, not from randomized controlled trials.

Suggested next steps for researchers and practitioners interested in economic impacts: pilot GAIE in controlled production settings, collect microdata on task classification frequencies and review times, and run cost–benefit and general equilibrium analyses of labor reallocation and market structure effects.