Platform Engineering in the Agent Era: Building Internal Developer Platforms for Humans and AI Agents

An internal developer platform (IDP) in the agent era serves two classes of user: the engineers who build software, and the AI agents that now build it alongside them. What changes is accountability. When an agent opens a pull request, provisions an environment, or calls an internal API, the platform is the only place that can establish which agent acted, under whose authority, and whether the change was permitted.

The division of labor is straightforward: engineers carry judgment, accountability, and institutional knowledge; agents carry scale, repetition, and speed.

Agentic AI is proven in production, which moves the constraint. Models and agent frameworks are abundant and getting cheaper, so acquiring the capability is no longer the hard part. Running it safely inside a regulated environment is where enterprises get stuck, and that is a platform problem before it is an AI problem.

Most enterprises did not decide to grant agents platform access. The platform granted it, because it was built to serve whoever presented a valid token. That gap sits inside infrastructure the platform team already owns, and it widens with every agent added.

A platform capability that reduces friction for a human developer constrains behavior for an agent. That inversion applies to golden paths, defaults, service catalogs, and developer portals alike.

Human developers handle gaps in a platform by exercising judgment. A developer who hits an underspecified golden path asks a colleague who knows the way forward, and proceeds. The gap stays invisible because human judgment fills it multiple times a week without anyone recording that it happened.

Agents have no equivalent behavior. An agent that meets an underspecified path proceeds with an improvised approach, then applies the same improvisation everywhere else it operates. Platform teams are being asked to achieve something new with infrastructure they have not changed, which is why existing tooling often looks adequate until an agent begins using it.

Google Cloud’s 2025 DORA report, based on nearly 5,000 technology professionals, puts numbers to the consequence. AI adoption shows a positive relationship with delivery throughput and a persistent negative relationship with delivery stability. 90% of organizations have adopted at least one internal platform, and the quality of that platform correlates directly with the organization’s ability to convert AI adoption into value. Acceleration exposes whatever the delivery system was already weak at, and in most enterprises the platform is the delivery system.

• Agent identity and scoped permissions. Every agent that touches production needs its own scoped, revocable, attributable identity, issued and governed the way employee access is governed. Most agents currently operate under credentials inherited from the team that built them, which makes the forensic question after a failure unanswerable.
• Golden paths expressed as executable policy. A golden path that exists only as documentation does not function as a golden path for a machine. Standards move out of prose and into policy-as-code, structured service catalogs, contract definitions, and machine-readable context the agent retrieves at execution time.
• Promotion gates between sandbox and production. Agents cannot accumulate the reputation that grants human engineers latitude. Version 12 carries none of the standing version 11 built, so the platform supplies what tenure supplies for people: role-based approval, versioning, and a certification path.
• Decision-level observability. Agent telemetry has to capture what the agent was asked, what context it retrieved, what it decided, and what it changed. Without that trail there is no audit, and without an audit, there is no deployment in banking, healthcare, or life sciences.

Gartner’s top strategic technology trends for 2026 describe leading organizations building small platform teams that let non-technical domain experts produce software themselves, with security and governance guardrails in place. They predict that by 2030, AI-native development platforms will result in 80% of organizations evolving large software engineering teams into smaller, more nimble teams that are augmented by AI.

The prediction describes a change in team shape. The platform is the mechanism that makes that change survivable. Widening the population that can produce software works only if the platform enforces everything the widened population does not know, and enforces it without a human standing at every gate.

That moves the IDP out of the developer-productivity budget line and into enterprise AI policy. It is also what separates AI platform engineering from the discipline it grew out of: the same tooling, now carrying compliance weight. Risk falls, capital stops leaking into ungoverned consumption, and delivery speed rises because the controls are built in rather than bolted on afterwards.

Across the enterprise, agents are appearing everywhere. Engineering has them. Operations has them. Finance has them. Most work. They just do not work together, and no single team owns the surface where they meet.

Without orchestration, that sprawl generates the kind of risk a regulated enterprise cannot absorb: inconsistent guidelines, conflicting decisions, no audit trail, and no way to ensure agents work with each other rather than against each other.

Agent governance only functions when it is centralized. Checkpoints, escalation rules, and audit trails only mean something when every agent is subject to them. Ascendion’s agentic AI platform for enterprise, AAVA™, serves as the orchestration layer that meets that precondition. AAVA is to enterprise agents what GitHub is to enterprise code: a centralized, governed home for the constellation of agents the business runs on, with the discipline to keep them coordinated, configured, and accountable.

Ascendion is an AI-native software engineering services company that built its own agentic AI platform and runs it at enterprise scale inside client environments. Services-as-Software is the category Ascendion created and leads, and Engineering to the Power of AI™ is the method. AAVA is the operational system that runs the method in production.

AAVA addresses these requirements in the platform rather than in documentation. Centralized, data-driven management of every agent provides versioning, approval workflows, and role-based access control, and rule-based approvals with validation workflows ensure only certified agents reach production. Certified “Golden Agents” proven in one deployment are shared across teams, so enterprises build once and scale everywhere. Structured promotion workflows move agents from sandbox to enterprise environments. AAVA OneView unifies visibility across the agentic SDLC, with every agent execution fully traceable and auditable and continuous tracking of cost, usage, and latency.

Guardrails sit alongside that governance layer, covering hallucination prevention, bias detection, sensitive data redaction, and protection against prompt injection and zero-click vulnerability attacks. Controls of this kind matter most where an unexplained decision carries regulatory consequences, which is where AAVA runs today.

A 200-year-old UK retail bank turned to AAVA after a £50M transformation had already failed. Ascendion mapped the architecture in weeks rather than months, protected 5.2 million customers through the rebuild, and delivered 50 to 75% velocity gains. A statutory deadline puts the same governance question under different pressure: on a US healthcare payer’s dual-eligible program, Ascendion’s testing transformation on AAVA helped the client serve a million members and meet the CMS deadline with zero slippage. Ascendion applies the platform to its own delivery as well, where 52% of production code is AI-generated, so the governance model meets its own release schedule before it reaches a client’s.

Across the client base, 12,000+ agents now run in production on AAVA. With that record, ISG named Ascendion an AI Leader in the ISG Provider Lens® Digital Engineering Services 2026 report. Additionally, Ascendion was appraised at Maturity Level 5 in the Capability Maturity Model Integration (CMMI®) Multi-Model Version 3.0.