AI Governance

Dropping QA to Go Faster With AI Is the Most Expensive Shortcut in Software

A few days ago I watched a presenter describe quality assurance as something the team had set aside to capture AI productivity. Here is why that should worry anyone building or buying with AI, and the verification framework we use instead.

By Gabe Gramajo  ·  Founder & CEO, Ideas Factory  ·  November 2, 2026

The sentence that stopped me

For most of its run time, the presentation was impressive. Agents writing code, agents triaging tickets, agents shipping in hours what used to take weeks. Then came the line that has stayed with me since: quality assurance had been dropped to the floor so the team could keep up with the productivity gains.

Nobody pushed back. A few people nodded.

I have spent more than 20 years in IT, and a good part of that time as the person who gets called when a system nobody tested starts losing money. I once had to recover an $800,000 invoicing system. Nobody cut quality to hurt anyone. They cut it to go faster.

So let me say it plainly. Dropping QA is not a productivity strategy. It is a decision to move the cost of defects from the build phase to your customers.

The speed is real. So is the bill.

Google's DORA research program surveyed nearly 5,000 technology professionals for its 2025 State of AI-assisted Software Development report. The headline: AI adoption is now associated with higher delivery throughput, and it is still associated with higher delivery instability. DORA's own summary is that AI acts as an amplifier. It magnifies what a team already is, strengths and dysfunctions alike.

Put a team with weak quality practices behind an amplifier and you get more broken releases, faster.

Security tells the same story. Veracode tests AI-generated code against known vulnerability patterns. Its October 2026 edition, covering 18 models across Python, C#, JavaScript and Java, reported the first meaningful improvement since the series began: the average security pass rate climbed to 62 percent. That still means roughly 38 percent of tasks produced vulnerable code when the model got no security-specific guidance. The best models scored 73 percent, so even the top of the leaderboard fails more than one task in four. On log injection, the pass rate sat at 13 percent.

Code that runs is not the same as code that is safe. AI is now excellent at the first and still unreliable at the second.

Why it feels faster than it is

In 2025 the research nonprofit METR ran a randomized trial with 16 experienced open-source developers working 246 real tasks in their own repositories. With AI tools allowed, tasks took 19 percent longer. Afterward, the same developers estimated they had been 20 percent faster. That is a 39-percentage-point perception gap.

Why the disconnect? Because typing code and watching tokens stream across the screen creates an immediate dopamine hit of velocity. What stays invisible is the cognitive fatigue that follows: unpicking probabilistic edge cases, parsing subtle hallucinated methods, and fixing architectural drift that never should have slipped into the codebase.

When an agent writes 400 lines of code in fifteen seconds, human review doesn't speed up—it bogs down. If a team responds by abandoning testing to keep up with generation, they haven't saved time. They have simply deferred the bill to the weekend on-call rotation.

The compounding cost of downstream defects

In software engineering, Barry Boehm's cost-of-change curve remains undefeated: catching a defect during specification or automated unit tests costs tens of dollars. Catching it in integration costs hundreds. Recovering from it in production costs tens of thousands, not including lost customer goodwill and churn.

When teams drop QA, they trade high-velocity generation for catastrophic production incidents. For small and mid-market organizations without surplus engineering teams to babysit broken deploys, a single corrupted data migration or auth leak can erase months of hard-won growth.

The five-guardrail verification framework

At Ideas Factory, we build with AI every single day. We use generative systems to scaffold prototypes, synthesize complex migrations, and accelerate development. But we never drop quality assurance. Instead, we wrap every AI pipeline in a strict five-guardrail verification framework:

1. Automated Test Harnesses Before Generation

   Never prompt an AI agent to write application logic without first establishing deterministic test specifications. Unit tests, integration fixtures, and system invariant assertions must execute automatically. If tests fail, the build fails—no exceptions.

2. Automated SAST & Dependency Scanning

   Every commit generated by AI undergoes automated static analysis (SAST), vulnerability checks, and secret auditing before human review. Known vulnerability signatures, injection paths, and deprecated packages are blocked at the pull request boundary.

3. Least-Privilege Agent Sandboxing

   Synthetic developer agents operate under strict least-privilege policies. They run with short-lived tokens, isolated staging databases, and zero production destruction permissions. An agent can propose changes; it can never bypass deployment policy.

4. Deterministic Business Logic Isolation

   Keep financial calculations, regulatory constraints, billing formulas, and access controls in verifiable, deterministic modules. Never outsource mathematical or compliance-critical logic to probabilistic model inference.

5. Human Engineering Gate at Consequence Boundaries

   Automate repetitive testing and linting, but require experienced human sign-off at critical consequence boundaries: schema migrations, payment flows, and customer data handoffs. High-velocity tooling should sharpen human focus, not replace engineering judgment.