Shift Left, For Real: Testing and Security Belong in the Spec

Background The risk-based framework I built scores and gates test suites. The AI extension does the same for agents and LLM features. Both answer how much testing, and where it blocks a merge. Neither answers when. The Problem Lately, when has been the problem. A feature ships, the PR lands, and that’s the first time QA sees it. Testing becomes archaeology: reconstruct what the feature was supposed to do from the diff, then work out what wasn’t tested. ...

August 20, 2026 · 4 min

Testing What You Can't Enumerate: A QA Framework for AI Agents and LLMs

Background Last month I wrote about the risk-based testing framework I built to keep QA on pace with agentic coding: twenty test categories five phases a scoring rubric that decides where the effort goes. Then the products started shipping AI features. They were the same products as before, handling PII and other regulated, person-level business data. The Problem The original framework breaks in four places. You can’t enumerate the input space. 80% line coverage means something. “80% of prompts” means nothing. There is no denominator. ...

August 10, 2026 · 10 min