Somewhere between commit and production, the AI productivity gains disappear. Not because the tools aren’t working — they are, measurably, at the developer level. The problem is everything downstream. Security reviews, governance checkpoints, legacy dependency chains, cross-team handoffs: none of these got faster when AI arrived, and all of them are now handling more volume than they were built for.

This IBM whitepaper starts where the developer tooling conversation usually stops — the moment code leaves someone’s IDE and has to survive contact with actual enterprise infrastructure. That’s the delivery problem, and it’s been hiding behind the velocity numbers. IBM lays out three paths: build internally, assemble a toolchain, or integrate an SDLC partner. Bob, their SDLC partner, is the product answer — a single governance layer spanning human developers and AI agents, with security built into the point of code generation rather than waiting at the end of the pipeline.

Key takeaways

• The delivery problem is structural, not a tool gap — adding more AI to a fragile pipeline makes it fragile faster
• Most enterprises gave AI to developers without asking what governance looks like at 10x code volume
• Platform teams, product teams and regulated environments don’t share the same delivery constraints; one tool governing all of them equally is a governance fiction
• Security at the point of generation and security at the end of the pipeline are different things — the paper is specific about why that distinction matters in practice
• The “build it yourself” path costs more and takes longer than early estimates suggest; the paper makes that case without overselling the alternative
• AI’s cost model is consumption-based and variable; most engineering budgets weren’t structured for that, and it’s already showing up in finance conversations