Skip to content

Frameworks

The framework ships eight named practices. Together they cover the AI-assisted software development lifecycle from first prompt to long-term maintenance:

prompt → first draft → review → merge → secure → refactor → document → collaborate

Each practice is an acronym chosen to be memorable on a whiteboard. None of them is novel in isolation; every component appears in some form in older software-engineering literature. What is new is the combination, the sequencing, and the explicit assumption that the code under discussion was co-authored by a model.

Why eight, not three

Three big practices would be easier to remember and harder to apply. The eight here are deliberately scoped so that each one fits in a single training session, a single review checklist, or a single Decision Record. If a practice cannot be taught in 60 minutes, it has been split.

The eight practices

  • S.C.A.F.F. Specify, Context, Action, Format, Failure-modes. The prompt structure that gives the model enough to produce useful first drafts.

  • V.E.R.I.F.Y. Validate intent, Examine output, Run tests, Inspect side-effects, Fact-check sources, Yield decision. The protocol the developer runs before accepting AI-generated code.

  • S.E.C.U.R.E. Scan dependencies, Evaluate threat surface, Check secrets, Use least privilege, Review logs, Enforce policy. The security layer of V.E.R.I.F.Y. for every diff that touches sensitive surface area.

  • S.H.I.E.L.D. Secure-by-default, Harden boundaries, Isolate workloads, Encrypt at rest and transit, Log everything, Detect anomalies. The programmatic security stance for AI-assisted systems.

  • C.L.E.A.R. Context, Logic, Edge-cases, Architecture, Readability. Code review reframed for AI-generated diffs, where the reviewer is verifying the human's understanding, not just the code.

  • R.E.F.A.C.T. Recognize smell, Extract intent, Flatten complexity, Add tests first, Change in small steps, Track regressions. The safe pattern for asking AI to refactor existing code.

  • D.O.C.S. Discover audience, Organize by task, Clarify with examples, Sustain through ownership. When AI helps documentation, when it hurts, and how to assign durable ownership.

  • C.O.D.E.S. Charter, Onboard, Decide, Educate, Sync. The team-level practice for adopting AI assistants together rather than as scattered solo behavior.

Where each practice fits in the SDLC

The practices are not parallel; they map onto distinct phases of the work.

SDLC phase Primary framework Supporting frameworks
Prompt the model S.C.A.F.F. C.O.D.E.S. (shared library)
Receive a first draft V.E.R.I.F.Y. S.E.C.U.R.E. (security-sensitive paths)
Review the diff C.L.E.A.R. V.E.R.I.F.Y., S.E.C.U.R.E.
Merge to main S.E.C.U.R.E. C.L.E.A.R. (final pass)
Operate the system S.H.I.E.L.D. Incident response
Modernize / clean up R.E.F.A.C.T. V.E.R.I.F.Y.
Document the result D.O.C.S. C.O.D.E.S. (assigning owners)
Spread the practice C.O.D.E.S. All of the above

Read top-down for the per-change loop. Read S.H.I.E.L.D. and C.O.D.E.S. as the standing posture: the platform conditions and team conditions that make the per-change loop possible.

How the practices reinforce each other

graph LR
    SC[S.C.A.F.F.<br/>prompt] --> VR[V.E.R.I.F.Y.<br/>verify]
    VR --> SE[S.E.C.U.R.E.<br/>security per change]
    VR --> CL[C.L.E.A.R.<br/>review]
    SE --> CL
    CL --> RF[R.E.F.A.C.T.<br/>refactor when needed]
    CL --> DC[D.O.C.S.<br/>document]
    SH[S.H.I.E.L.D.<br/>standing security]
    CO[C.O.D.E.S.<br/>standing team practice]
    CO -.- SC
    CO -.- CL
    SH -.- SE
    SH -.- VR

Solid arrows are per-change flow. Dotted lines are the standing practices that hold the per-change flow together.

Sizing guidance

Sizing guide

  • Small (< 50 people). Adopt S.C.A.F.F. and C.L.E.A.R. first. They produce immediate quality lift with the lowest ceremony. Fold S.E.C.U.R.E. into your existing review checklist rather than running it as a separate gate. Skip S.H.I.E.L.D. as a formal program; pick its highest-value control (egress allow-listing) and run it.
  • Mid (50–500). Add S.E.C.U.R.E. and S.H.I.E.L.D. once you have more than one team using AI assistants in earnest. C.O.D.E.S. becomes load-bearing here; without it, every team reinvents prompt patterns.
  • Enterprise (500+). All eight practices, with D.O.C.S. and C.O.D.E.S. elevated to programs (named owners, recurring cadence, training curriculum). R.E.F.A.C.T. is essential for legacy modernization at this size.
  • Regulated. All eight practices are required, not optional. S.E.C.U.R.E. and S.H.I.E.L.D. tie into the regulatory mapping. Audit evidence flows from V.E.R.I.F.Y. and C.L.E.A.R. into the audit trail.

How a practice page is structured

Every framework page on this site uses the same shape:

  1. What it is. One paragraph, the acronym expanded.
  2. When to use it. Which SDLC phase, which risk tiers.
  3. The acronym in detail. One section per letter, with worked examples where useful.
  4. Sizing guidance. Small, Mid, Enterprise, Regulated.
  5. Cross-links to the worksheets, governance, and evidence pages that depend on or extend the practice.
  6. Anti-patterns. Three to five things to avoid, in a !!! danger block.

Where to start reading

  • New to the framework: read S.C.A.F.F. and V.E.R.I.F.Y. in that order. They are the per-change spine.
  • Security-led adoption: read S.H.I.E.L.D. first (standing posture), then S.E.C.U.R.E. (per-change controls).
  • Engineering-manager-led adoption: start with C.O.D.E.S. to get the team rhythm in place, then layer the per-change practices.

How the frameworks tie back to the rest of the site

Framework Anchored worksheet Anchored governance
S.C.A.F.F. Pilot scope AUP
V.E.R.I.F.Y. SDLC mapping Risk classification
S.E.C.U.R.E. Incident tabletop Incident response
S.H.I.E.L.D. Incident tabletop Data handling
C.L.E.A.R. Pilot retrospective RACI
R.E.F.A.C.T. Pilot scope Risk classification
D.O.C.S. Decision record Audit trail
C.O.D.E.S. Training needs, Leadership charter RACI

Anti-patterns

Don't

  • Don't adopt all eight at once. Adoption that tries to land eight practices in a quarter lands none of them. Sequence according to the sizing guide above.
  • Don't rename the acronyms to fit a tool. They are intentionally vendor-neutral. If a vendor's marketing aligns to one of them, that is convenient; if it does not, the framework is not the bug.
  • Don't skip C.O.D.E.S. on the assumption that "we already do teamwork." AI assistants change how teams interact in ways that pre-existing rituals were not designed to handle.
  • Don't treat S.H.I.E.L.D. as a one-time setup. It is a standing posture. Egress allow-lists, sandbox boundaries, and anomaly detection drift the moment they are not maintained.

Next