AI Under Control : accélérer en sécurité

Présenté par Cyrille Martraire (Arolla) et Dorra Bartaguiz (Arolla) à Agile en Seine le 8 octobre 2025
L’état de l’art de l’IA permet d’accélérer de nombreuses tâches des métiers du développement logiciel, et devient incontournable. Mais l’usage généralisé de l’IA sur des sujets de code amène des enjeux exacerbés de fiabilité et d’une quantité accrue de code legacy.

Dans ce talk nous proposerons un cadre pour structurer les différentes approches (specs, code, tests, contexte engineering) pour adresser les limites et concilier vitesse, fiabilité, et pérennité. Vous en retirerez une meilleure appréhension de vos enjeux dans la mise en oeuvre de l’IA pour les devs, ainsi que des idées à expérimenter ou à renforcer dans vos équipes.

1. AI UNDER CONTROL:
ACCÉLÉRER EN SÉCURITÉ

2. Merci à nos partenaires

3. AI UNDER CONTROL:
ACCÉLÉRER EN SÉCURITÉ

4. AI x CRAFT:
DELIVER, FASTER, SAFER

5. Since yesterday…

6. You’ve seen
demos…

7. AI will replace team
devs.

8. @cyriux @arollafr
U serious?

9. "AI will replace
team devs."
— non-dev team

10. "AI will replace
team devs."
AI will NOT replace
team devs.
— dev teams
— non-dev team

11. @cyriux @arollafr
But AI is so
impressive
for coding!

12. @cyriux
And a bit
dangerous
too…

13. How to do AI?

14. DORRA BARTAGUIZ
@CYRIUX @AROLLAFR
15 years - 18M€ CA - 130 colleagues
CTO

15. CYRILLE MARTRAIRE
@CYRIUX @AROLLAFR
15 years - 18M€ CA - 130 colleagues
Co-founder

16. arolla.fr @arollafr
TDD | BDD | DDD

17. arolla.fr @arollafr
crafting architecture

18. arolla.fr @arollafr
Trainings
Consulting
Projects

19. @cyriux
BUY OUR BOOKS!

21. AI for developers.

22. LLM & chats.




AI PANORAMA
ChatGPT, Claude, Gemini

23. LLM & chats.
Coding Assistants.



AI PANORAMA
ChatGPT, Claude, Gemini
Copilot, smart autocomplete
Sweep
ContinueCodiumAI
Cogram, MutableAI, Tabnine
Cody
CodeWhisperer

24. LLM & chats.
Coding Assistants.
AI-IDE’s


AI PANORAMA
ChatGPT, Claude, Gemini
Copilot, smart autocomplete
Cursor, Windsurf
Claude Code
Sweep
ContinueCodiumAI
Cogram, MutableAI, Tabnine
Cody
CodeWhisperer

25. LLM & chats.
Coding Assistants.
AI-IDE’s
Agentic Assistants

AI PANORAMA
ChatGPT, Claude, Gemini
Copilot, smart autocomplete
Cursor, Windsurf
Cline, Roo, Junie
Claude Code
Sweep
ContinueCodiumAI
Cogram, MutableAI, Tabnine
Cody
CodeWhisperer

26. LLM & chats.
Coding Assistants.
AI-IDE’s
Agentic Assistants
Mix of simpler tools.
AI PANORAMA
ChatGPT, Claude, Gemini
Copilot, smart autocomplete
Cursor, Windsurf
Cline, Roo, Junie
repomix, aider,
Claude Code
Sweep
ContinueCodiumAI
Cogram, MutableAI, Tabnine
Cody
CodeWhisperer

27. LLM & chats.
Coding Assistants.
AI-IDE’s
Agentic Assistants
Mix of simpler tools.
AI PANORAMA
ChatGPT, Claude, Gemini
Copilot, smart autocomplete
Cursor, Windsurf
Cline, Roo, Junie
repomix, aider,
Claude Code
Sweep
ContinueCodiumAI
Cogram, MutableAI, Tabnine
Cody
CodeWhisperer
MCP, A2A…

28. LLM & chats.
Coding Assistants.
AI-IDE’s
Agentic Assistants
Mix of simpler tools.
AI PANORAMA
ChatGPT, Claude, Gemini
Copilot, smart autocomplete
Cursor, Windsurf
Cline, Roo, Junie
repomix, aider,
Claude Code
Sweep
ContinueCodiumAI
Cogram, MutableAI, Tabnine
Cody
CodeWhisperer

29. where to use AI?

30. dont look too far
to use AI

31. Focus on repetitive and
laborious tasks

32. Exploration Formulation
Decomposition
Développement
Refactoring
Development practices
Automation

33. Exploration Formulation
AutomationDecomposition
Développement
Refactoring
Development practices

34. @cyriux @arollafr
AI everywhere,
all the time!

35. @cyriux
What could
go wrong?

36. @cyriux
https://codescene.com/hubfs/whitepapers/Refactoring-vs-Refuctoring-Advancing-the-state-of-AI-
automated-code-improvements.pdf
AI-based refactoring:
may not improve the code
quality, or even degrade it
Code Scene
may introduce subtle bugs (eg
reversed conditions)
don’t even always compile

37. @cyriux
https://cloud.google.com/resources/content/dora-impact-of-gen-ai-software-development
The "productivity paradox"
7.2% production instability for every 25% usage of coding
assistants
Production instability risk
Lots of positives, but:
Going faster doesn’t mean delivering faster

38. @cyriux
https://www.gitclear.com/ai_assistant_code_quality_2025_research
More churn,
duplication
They analyzed 153M lines of code
GitClear
"the frequency of copy/pasted
lines increased 6% faster than our
prediction"

39. ‘lines of code’:
NOT a measure of
productivity
!

40. @cyriux

41. AI is good to
generate tech debt

42. AI is so powerful we
risk cognitive
overload

43. @cyriux
Copilot is lost.
How do I get
back on track?

44. @cyriux @arollafr
git = UNDO
button for AI

45. One more thing

46. @cyriux

47. Generating code, not
even looking at it.

48. Demonstrate behavior
quickly, get feedback.


VIBE CODING: LOWERING THE BARRIER

49. Create a POC or MVP
without coding

50. DevGPT
Smol Developer
GPT Engineer
Frameworks pour créer des MVPs en solo
Bolt
Génération d’un POC/MVP
AutoGPT
AgentCoder
SWE-agent
Prometteurs pour automatiser les
développements de tout un environnement
(code, tests, bases...)
StackBlitz AI
WebContainers AI
Utile pour des POCs
Replit Ghostwriter
Développer en ligne dans l’IDE Replit
pour des MVP
And more..
POC without
devs
Create a POC or MVP
without coding

51. @cyriux

52. @cyriux

53. @cyriux

54. @cyriux

55. Vibe coding is VERY
good at generating
tech debt

56. @cyriux
Vibe Wrangling vs. Software Engineering
— Simon Wardley

57. @cyriux
Vibe Wrangling vs. Software Engineering
I DON’T care about decisions
in code for this thing.
— Simon Wardley
•Emergent discovery.
•Deals with more complex spaces.
•Good for prototypes.

58. @cyriux
Vibe Wrangling vs. Software Engineering
I DO care about decisions in
code for this thing.
— Simon Wardley
•Dynamic discovery, AI-assisted.
•Deals with more complicated spaces.
•Good for running systems.

59. Demonstrate behavior
quickly, get feedback.
Then rebuild using
software engineering.
VIBE CODING: EXECUTABLE SPECS FTW

60. @cyriux @arollafr
AI everywhere,
to go faster!

61. @cyriux
How to
make it
safer too?

62. @cyriux @arollafr
Your job is
software
engineering!

63. It takes good brakes to go fast

64. @CYRIUX
AI UNDER CONTROL

65. Craft AI
The 4 QUADRANTS
by AROLLA

66. Preventive
Machine
Defensive
Human
43
2 1
LES QUADRANTS AI Under Control: The 4 Quadrants

67. Preventive
Linters
Packmind
Tests, ArchUnit tests
Machine
Defensive
Human
43
2 1
LES QUADRANTS
automation after commits
AI Under Control: The 4 Quadrants

68. Preventive
Linters
Packmind
Tests, ArchUnit tests
AI tools rulesets
Living Documentation,
ADR’s
Clean or hide horrors
Machine
Defensive
Human
43
2 1
LES QUADRANTS
automation before commits automation after commits
AI Under Control: The 4 Quadrants

69. Preventive
Linters
Packmind
Tests, ArchUnit tests
AI tools rulesets
Living Documentation,
ADR’s
Clean or hide horrors
Machine
Defensive
Human
knowing what we want
Training, upskilling
Mob-programming
Team standards
43
2 1
LES QUADRANTS
automation before commits automation after commits
AI Under Control: The 4 Quadrants

70. Preventive
Linters
Packmind
Tests, ArchUnit tests
AI tools rulesets
Living Documentation,
ADR’s
Clean or hide horrors
Machine
Defensive
Human
knowing what we want
Training, upskilling
Mob-programming
Team standards
43
2 1
LES QUADRANTS
automation before commits automation after commits
AI Under Control: The 4 Quadrants

71. Preventive
Linters
Packmind
Tests, ArchUnit tests
AI tools rulesets
Living Documentation,
ADR’s
Clean or hide horrors
Reviews in small batches
Refactoring decisions
Retrospectives
Machine
Defensive
Human
knowing what we want discovering what we really wanted
Training, upskilling
Mob-programming
Team standards
43
2 1
LES QUADRANTS
automation before commits automation after commits
AI Under Control: The 4 Quadrants

72. Preventive
Linters
Packmind
Tests, ArchUnit tests
AI tools rulesets
Living Documentation,
ADR’s
Clean or hide horrors
Reviews in small batches
Refactoring decisions
Retrospectives
Machine
Defensive
Human
knowing what we want discovering what we really wanted
Training, upskilling
Mob-programming
Team standards
43
2 1
automation before commits automation after commits
AI Under Control: The 4 Quadrants

73. @cyriux @arollafr
Context
Engineering!

74. where to use AI?

75. dont look too far
to use AI

76. Preventive
Linters
Packmind
Tests, ArchUnit tests
AI tools rulesets
Living Documentation,
ADR’s
Clean or hide horrors
Reviews in small batches
Refactoring decisions
Retrospectives
Machine
Defensive
Human
knowing what we want discovering what we really wanted
Training, upskilling
Mob-programming
Team standards
automation before commits automation after commits
AI Under Control: AI to help build control

77. Preventive
Linters
Packmind
Tests, ArchUnit tests
AI tools rulesets
Living Documentation,
ADR’s
Clean or hide horrors
Reviews in small batches
Refactoring decisions
Retrospectives
Machine
Defensive
Human
knowing what we want discovering what we really wanted
Training, upskilling
Mob-programming
Team standards
LES QUADRANTS
automation before commits automation after commits
explore
literature
AI Under Control: AI to help build control
sum up team
favorites

78. Preventive
Linters
Packmind
Tests, ArchUnit tests
AI tools rulesets
Living Documentation,
ADR’s
Clean or hide horrors
Reviews in small batches
Refactoring decisions
Retrospectives
Machine
Defensive
Human
knowing what we want discovering what we really wanted
Training, upskilling
Mob-programming
Team standards
LES QUADRANTS
automation before commits automation after commits
explore
literature
retrogen
doc
prepare
rulesets
AI Under Control: AI to help build control
sum up team
favorites

79. Preventive
Linters
Packmind
Tests, ArchUnit tests
AI tools rulesets
Living Documentation,
ADR’s
Clean or hide horrors
Reviews in small batches
Refactoring decisions
Retrospectives
Machine
Defensive
Human
knowing what we want discovering what we really wanted
Training, upskilling
Mob-programming
Team standards
LES QUADRANTS
automation before commits automation after commits
explore
literature
generate
custom
extensions
help
configure
tools
generate
tests
retrogen
doc
prepare
rulesets
AI Under Control: AI to help build control
sum up team
favorites

80. Preventive
Linters
Packmind
Tests, ArchUnit tests
AI tools rulesets
Living Documentation,
ADR’s
Clean or hide horrors
Reviews in small batches
Refactoring decisions
Retrospectives
Machine
Defensive
Human
knowing what we want discovering what we really wanted
Training, upskilling
Mob-programming
Team standards
LES QUADRANTS
automation before commits automation after commits
explore
literature
help
visualize
generate
custom
extensions
help
configure
tools
generate
tests
retrogen
doc
prepare
rulesets
AI Under Control: AI to help build control
sum up team
favorites

81. @cyriux
A few
examples

82. @cyriux
From the list of source code files of the application,
recognize the common architecture patterns used in the
application.
Domain-Driven Design (DDD): ...
Layered Architecture: ...
Adapter Pattern: ...
Data Access Object (DAO) Pattern: ...
Reverse-engineering documentation
(as-is, good naming)

83. @cyriux
From the list of source code files of the application, and
knowing it conforms to the hexagonal architecture pattern,
generate a context diagram (as in Simon Brown's C4 model) of
it in the dot file format to be rendered as diagram by
graphviz; put the domain in the middle, and list every
external touchpoint around, putting on the left the ones
using the domain, and putting on the right the ones
providing value to the domain.
context_diagram.dot
Reverse-engineering documentation
(as-is, good naming, plus a hint)

84. @CYRIUX
External Touchpoints Using the Domain
External Touchpoints Providing Value to the Domain
Domain
- Basket
- Coordinates
- DistanceUnit
- FuelCardMonitoring
- FuelCardTransaction
- FuelCardTransactionReport
- FuelEconomy
- FuelCard
- GeoDistance
- Geocoding
- LocationTracking
- Merchant
- Money
- Vehicle
- VolumeUnit
FuelCardTxListener
ReportDAO
SmartGISGeoCodingAdapter
WebServiceGPSTrackingAdapter
VehicleDatastore
FuelCardResource
ReportResource
FuelCardJMXBean
Reverse-engineering documentation

85. @cyriux
Please generate a brief ADR file to explain and justify the
hexagonal architecture here. This ADR file will be the root
of the project in an ADR/ folder.
Adding the documentation to the
projet (less need for reverse-
engineering next time)

86. @cyriux
Please generate a brief ADR file to explain and justify the
hexagonal architecture here. This ADR file will be the root
of the project in an ADR/ folder.
Adding the documentation to the
projet (less need for reverse-
engineering next time)

87. @cyriux
Please generate a brief ADR file to explain and justify the
hexagonal architecture here. This ADR file will be the root
of the project in an ADR/ folder.
Adding the documentation to the
projet (less need for reverse-
engineering next time)
?!

88. New Claim Management as Single Source of Truth until the claim is
accepted by the customer
Accepted on 01/12/2015
Context
We want avoid confusion arising from unclear authority of data, which
consumes developer time to fix failing reconciliations. This requires that
only source of truth (aka Golden Source) can exist at any point in time for a
given piece of domain data.
Decision
We decide that Claim Management is the only source of truth (aka Golden
Source) for Claim on claim inception and until the claim is accepted by the
customer, at which time it is pushed to the legacy claim mainframe. From
the moment it is pushed, the only source of truth is the legacy claim
mainframe (LCM).
ADR
Decision Log

89. @cyriux
in-situ
knowledge:
less to put into the prompt

90. @cyriux
AI UNDER CONTROL (HUMAN + TOOLS)
WE’RE EXPERIMENTING!

91. @cyriux
reverse-engineer tests (characterization tests
& oracles)
guide mass-refactoring, done by deterministic
tooling (codemods), under control from static
analysis (linter & tools like Packmind)
AI UNDER CONTROL (HUMAN + TOOLS)

92. Preventive
Linters
Packmind
Tests, ArchUnit tests
AI tools rulesets
Living Documentation,
ADR’s
Clean or hide horrors
Reviews in small batches
Refactoring decisions
Retrospectives
Machine
Defensive
Human
knowing what we want discovering what we really wanted
Training, upskilling
Mob-programming
Team standards
43
2 1
LES QUADRANTS
automation before commits automation after commits
AI Under Control: Good techniques matter

93. Preventive
Linters
Packmind
Tests, ArchUnit tests
AI tools rulesets
Living Documentation,
ADR’s
Clean or hide horrors
Reviews in small batches
Refactoring decisions
Retrospectives
Machine
Defensive
Human
knowing what we want discovering what we really wanted
Training, upskilling
Mob-programming
Team standards
43
2 1
LES QUADRANTS
automation before commits automation after commits
AI Under Control: Good techniques matter

94. 4PGUXBSF
&OHJOFFSJOH
Since 1970

95. Wow.
That’s
very old,
isn’t it?

96. 4PGUXBSF
$SBGU
Since 2009

97. Wow.
That’s
also old,
isn’t it?

98. http://www.meetup.com/paris-software-craftsmanship/
PARIS SOFTWARE CRAFTERS COMMUNITY
Since 2011.
5000+ members

99. That’s a
lot of
people,
isn’t it?

100. @CYRIUX
Craft
RAISING THE
BAR
WORKING CODE
IS NOT ENOUGH

101. Build the right thing.
Build it right.

102. PROGRAMMING
BY COINCIDENCE

103. Software Craft

104. @CYRIUX
BENEFITS
TIME TO MARKET
RELEASE FREQUENCY
DEFECTS BY RELEASE
TIME TO RECOVER
EASIER EVOLUTIONS & MAINTENANCE
REDUCED COST OVER TIME
MORE VALUES DELIVERED
DIGITAL FRUGALITY

105. @cyriux @arollafr
It’s NOT
about AI!

106. TDD
BDD
DDD
Legacy
Continuous
Delivery
Software
Craftsmanship
FP-style
Clean
Code
DevOps

107. TDD
BDD
DDD
Legacy
Continuous
Delivery
Software
Craftsmanship
FP-style
Clean
Code
DevOps

109. Test = Just enough Specification
Code = Just enough Code
Refactor = Just enough Design
TDD

110. Test = Quality gate
Code = let AI do its thing
Refactor = Human supervision
Agentic loop

111. Pair-Programming

112. Driver-Navigator

113. Pair-Programming with AI

114. TDD
BDD
DDD
Legacy
Continuous
Delivery
Software
Craftsmanship
FP-style
Clean
Code
DevOps

115. Domain
Language
Conversations
Intent
3 amigos

116. Intent.
Personas.
Specific Language.
Concrete examples.
BEHAVIOR-DRIVEN DEVELOPMENT

117. Learning to prompt

118. Intent.
Personas.
Specific Language.
Concrete examples.
BEHAVIOR-DRIVEN DEVELOPMENT

119. Intent.
Personas.
Specific Language.
Concrete examples.
PROMPT ENGINEERING

120. TDD
BDD
DDD
Legacy
Continuous
Delivery
Software
Craftsmanship
FP-style
Clean
Code
DevOps

121. Craft
attitudes

122. THE SYSTEM
=
THE SOFTWARE
+
THE PEOPLE

123. @cyriux
https://cloud.google.com/resources/content/dora-impact-of-gen-ai-software-development
The "productivity paradox"
Going faster doesn’t mean delivering faster

124. @cyriux
Copilot is lost.
How do I get
back on track?

125. BABY STEPS

126. MICRO-SIZE

127. Generate stuff.
Not too much at a time, so
you can review.

128. Generate stuff.
If it’s hard to review,
it’s too big.

129. TASTE FOR SIMPLICITY

130. NAMING THINGS IS HARD
& IMPORTANT

131. THE MORE STANDARD THE BETTER
fogus
@fogus

132. LIVING DOCUMENTATION
= PROMPT YOU DON’T
HAVE TO WRITE

133. @cyriux
VIRTUOUS LOOP
BETTER
BETTER

134. Testing techniques: property-based testing, parallel run
diff analysis, test pyramid, golden master, fuzzing,
approval testing, model-based testing, characterization
testing, manual test plans…
Code improvement techniques: macro & large-scale
refactorings, large-scale renaming, domain language
clustering, reverse-documentation, living
documentation
REJUVENATE OLD / COSTLY TECHNIQUES

135. @CYRIUX
WHAT SKILLS FOR AI

136. ‣Investigative skills
‣Analytical skills
‣Curiosity / learn to learn
HUMAN SKILLS FOREVER

137. @CYRIUX
FRUGAL AI - HOW TO BE GREEN WITH AI?

138. Avoid
irrational
usage

139. Small models FTW!
Multiple dedicated models of various sizes (intent-
extraction, text, coding) or (reasoning, executing)

140. IA is powerful! It’s
so powerful it can
replace itself.
Great
News

141. 1. LLM to solve the problem (a
few times)
2. LLM to generate code that
solves the problem (from now
on, until it drifts)
FRUGAL AI

142. @CYRIUX
CONCLUSION

143. Louis-Guillaume MORAND, Eric GRENON - Microsoft (DevoxxFR 2023) : https://www.youtube.com/watch?v=vQqOV83ZMpE
History of AI

144. AI won’t disappear
overnight.
We all have to
adopt and adapt.

145. If you only use AI for
autocomplete, you
haven’t really started yet.

146. AI is a general purpose
technology.
There’s no user manual
on how to use it best.

147. Try things. Learn.

148. Co-Intelligence:
Living and
Working With AI
by Ethan Mollick

149. Try to use AI in everything
you do.
See for yourself when it’s
great, or frustrating.
From the book: Co-Intelligence: Living and Working With AI by Ethan Mollick

150. AI works best with
human help.
Be the human that knows
how best to help the AI.
From the book: Co-Intelligence: Living and Working With AI by Ethan Mollick

151. impressive
on topics
we know
little about.
AI IS OFTEN…

152. impressive
on topics
we know
little about.
AI IS OFTEN…
frustrating
on topics
we know
very well.

153. @cyriux
YOU NEED MORE
EXPERTISE, NOT LESS,
WITH IA FOR CODE
STUFF!

154. @cyriux
arolla.fr + newsletter
Thank you!