Agentic Coding: How It Works and How Much to Delegate

For an engineering lead, the practical default is a bounded task on an isolated branch, explicit acceptance criteria, automated checks and a named reviewer. Expand autonomy when that process produces changes you can confidently accept.

Tool behavior below was verified against the makers' live documentation on 24 October 2026. The delegation rules and invoice-export example are editorial analysis, not results from a product trial.

What Is Agentic Coding?

Agentic coding gives an AI system responsibility for a sequence of development actions, with feedback between them. It examines a codebase, plans a change, edits files, runs commands and tests, reads the results, and adjusts its next action. A run may stop when it finishes, hits a permission boundary or needs a decision.

Anthropic describes the underlying cycle as gathering context, acting and verifying. The crucial step is feeding the tool result back into the next decision: a failed test becomes evidence for another edit. A suggested code block alone does not provide that loop. Claude Code's agentic loop.

Think of a contractor renovating a room. The brief describes the result, the keys determine access, and the inspection determines acceptance. Giving the contractor more keys does not make the renovation correct. Coding agents need the same separation between instructions, access and inspection.

An agent also needs a harness, the software around the model that supplies tools and manages the working context. The model proposes actions; the harness executes permitted tool calls and returns their results. Changing the model does not automatically change the environment's access rules.

How an Agentic Coding Assistant Differs From Autocomplete and Chat

The difference is who carries the work between steps. Autocomplete suggests text while you edit. A plain chat exchange can explain code or propose a patch while you copy, execute and validate it. An agent with repository and command access can carry out those steps and inspect what happened.

The interface is not the definition. A chat window can host an agent, and a terminal can host one too. Look for the available tools, the feedback loop and the authority granted to the session.

Agentic Coding vs Vibe Coding

Agentic coding describes how the tool operates. Vibe coding commonly describes a way of working in which someone steers generated software mainly through prompts and observed behavior, sometimes with little inspection of the implementation. The terms overlap in practice, but they answer different questions.

You can use an agent while reviewing every change and maintaining rigorous tests. You can also accept generated code with almost no scrutiny. For a disposable prototype, that second approach may be a conscious tradeoff. For customer data or payments, understanding the implementation remains part of owning it. The vibe coding tools guide covers the broader field of builders and coding tools.

What Agentic Coding Tools Can Do

The main tools expose a similar action loop through different working surfaces. Their documented capabilities establish what you can delegate; they do not establish how much unsupervised work your repository can tolerate.

Claude Code

Claude Code, Anthropic's coding agent, can search a project, read and edit files, run commands and execute tests. Its documentation describes a loop that changes direction based on what it learns from each tool result. That makes a focused bug fix a natural task: investigate the failure, change the relevant code and verify the behavior. Claude Code documentation.

The practical wall is missing or forgotten context. Anthropic documents a finite context window and compaction during long sessions. Keep durable constraints in project instructions and keep each change focused; a long conversation is a poor substitute for an acceptance criterion. Our Claude Code best practices develops that workflow.

OpenAI Codex

OpenAI Codex, OpenAI's coding agent, offers a command-line interface (CLI) that can inspect a repository, plan a change, edit files and run local development commands. It also provides a dedicated review flow for uncommitted changes, a commit or a comparison against a base branch. Codex CLI documentation.

The practical wall is the execution environment. A check that needs an unavailable service or blocked network access cannot provide the evidence you intended. Record that check as unverified, then reproduce it in the appropriate environment. The Codex vs Claude Code comparison covers the product choice; permission settings deserve their own decision.

Cursor Agent

Cursor Agent, the coding agent in Cursor's editor, can search a codebase, edit files and run terminal commands. It suits an interactive workflow where you steer the change while inspecting the work. Those are documented actions, not a promise that a feature will be correct. Cursor Agent overview.

Its immediate boundary matters: ordinary workspace edits save to disk without approval, while configuration-file changes receive additional protection. Cursor warns that an app with auto-reload can execute edited code before you review it. Use a development environment whose credentials and data are appropriate for that behavior. Cursor Agent security.

GitHub Copilot's Coding Agent

GitHub Copilot's coding agent, described in the current documentation as Copilot cloud agent, can research a repository, plan changes, edit files and run tests and linters in an ephemeral cloud environment. It can prepare branches, commits and pull requests. This is distinct from receiving suggestions inside an IDE or asking Copilot to review an existing pull request. Copilot on GitHub.com.

The practical wall is the handoff. GitHub warns that generated changes can be inaccurate or insecure and require review and testing. A completed session means there is work to assess, not that your acceptance criteria have been met. GitHub's responsible-use guidance.

For plan details, use our Claude Code pricing, Codex pricing, Cursor pricing and GitHub Copilot pricing pages.

An Agentic Coding Workflow Starts With a Testable Spec

A useful specification tells the agent what must remain true, as well as what must change. “Add CSV export” leaves critical decisions open. An agent can produce a working download while implementing the wrong access rules.

Consider a hypothetical invoicing product used by separate customer organizations. You want an account administrator to export invoices. A useful task brief would specify:

• Outcome: an authorized administrator can download the invoices visible under the current filters.
• Access rule: an organization must never receive another organization's invoices, including through a manipulated request.
• Preserved behavior: existing invoice permissions and filtering remain authoritative.
• Scope: reuse the existing authorization and export conventions; avoid unrelated refactors or dependencies.
• Evidence: show permitted and denied cases, a cross-organization attempt, an empty result and the relevant existing checks.
• Stop condition: ask for a decision if the access policy is ambiguous or the fix requires changing shared authorization behavior.

This brief leaves implementation choices open while fixing the product contract. If the work reveals a missing rule, resolve it and update the specification. Do not let an implementation accident silently become policy. Our spec-driven development guide explains how to maintain that relationship.

Anthropic's best-practices documentation recommends giving the agent a way to verify its work. In his practitioner recommendations, Armin Ronacher emphasizes fast, understandable tools and useful logs. The operational lesson is to make failures observable: a readable authorization failure helps the agent correct its work; a hanging command provides little direction.

Permissions and Sandboxing Set Different Boundaries

Permissions govern allowed actions; sandboxing limits their reach; branch and review rules govern acceptance. Configure all of them. A prompt saying “do not touch production” cannot substitute for withholding production access.

An approval policy determines which actions need authorization. A sandbox is an enforced execution boundary around resources such as writable files and outbound network access. Neither evaluates whether the invoice export obeys your business rules.

Check the Effective Settings for Each Tool

For Claude Code, Anthropic documents filesystem and network isolation for sandboxed commands, including their subprocesses. It also documents an unsandboxed retry mechanism. Review that escape hatch, command exclusions and what happens when the sandbox cannot start before treating the boundary as mandatory. Restricting writes does not automatically mean sensitive files cannot be read. Claude Code sandboxing.

For Codex CLI, workspace-write with on-request approvals permits work inside the workspace while command network access is off by default unless enabled. Approval policy and sandbox mode are separate settings: disabling approval prompts does not itself remove the sandbox. The command network policy also does not, by itself, govern hosted web search, apps or MCP connections, which connect the agent to external tools and services. Review those access paths separately. Codex approvals and security.

For Cursor Agent, terminal commands require approval by default, while its configurable Run Modes are described as best-effort guardrails rather than a hard security boundary. That distinction matters if you plan to let commands run unattended. Account for the earlier auto-reload warning as well as terminal execution. Cursor Agent security.

For GitHub Copilot cloud agent, GitHub documents constrained branch permissions that prevent direct pushes to the default branch. It also documents a default firewall and approval by a user with write access before Actions workflows triggered by agent pull requests run. General repository and organization Actions secrets are not passed to the agent; secrets specifically added to the copilot environment are. Check what you put there. GitHub's documented safeguards.

Make the Boundary Match the Task

For the invoice export, the agent needs source code, development dependencies and synthetic invoice records. It should not need live customer invoices, production database credentials or authority to deploy. Grant the minimum resource access that lets it reproduce and verify the behavior.

Treat repository text, retrieved pages and issue content as potentially untrusted input. Prompt injection occurs when malicious content tries to redirect the agent's actions. An instruction hidden in a document should not acquire the authority of your task brief. Maker security guidance identifies this risk; limiting accessible resources reduces the possible consequences. Cursor's security model.

Review Practice: Inspect the Diff and the Evidence

Review the changed behavior and the checks that claim to prove it. Reading the agent's summary is useful orientation, but the summary is not the artifact you are approving.

Start with the acceptance criteria. For the invoice export, trace how the request's organization is determined, how authorization is checked and how the export query applies the same boundary. Then inspect the tests. A test that uses only one organization's records cannot demonstrate separation between organizations.

Next, look for ways the patch weakened the evidence: deleted assertions, newly skipped tests, broader mocks, changed snapshots or altered CI configuration. A test suite can become green because the implementation improved or because the check became less demanding. The diff tells you which happened.

From a repository checkout with uncommitted changes, these Git commands provide a basic inspection:

git status --short
git diff --stat
git diff --check
git diff
git diff --cached

git status also exposes untracked files, whose contents need separate inspection. These commands do not run application tests. For committed agent work, inspect the pull request's full base-to-head diff and run the repository's documented checks in a clean environment.

A useful handoff includes the exact commands executed, their outcomes, the relevant failure or success output, and any check that could not run. “Tests pass” without identifying the tests leaves the reviewer guessing about coverage. A failed environment setup is a blocker to evidence, not evidence that the code works.

Drew Breunig argues for tests of product behavior, documented intent and specifications that evolve with the implementation in 10 Lessons for Agentic Coding. Applied here, the durable check is that one customer cannot export another's invoices. The particular helper function used to enforce that rule can change.

An automated review can supply another set of findings, but the person accepting the change should understand its critical path. GitHub explicitly warns that AI review can miss problems and can produce false positives. Keep a human reviewer accountable for security-sensitive behavior and maintainability. GitHub's review limitations.

Who Should Delegate More, and Who Should Wait?

Delegate more when the task has a clear success condition, mistakes are contained and review remains manageable. The following is a suggested engineering policy, not a capability guarantee from any vendor.

Engineering leads with dependable CI can act now. Start with changes that follow existing patterns. Keep a named owner for each agent-generated pull request and reduce task size if reviews become difficult to reason through. Passing checks are useful only when they cover the behavior that matters.

Founders building a prototype can delegate implementation aggressively within a disposable environment. Use synthetic data and accept that exploratory code may be replaced. Before adding customer accounts or money movement, get someone capable of assessing the access rules, failure handling and operational consequences.

Maintainers of a poorly understood legacy system should first improve the evidence. An agent can help investigate behavior and propose tests, but unattended refactoring is a weak starting point when nobody can distinguish intended behavior from an accident. Establish the baseline before expanding autonomy.

People already happy with autocomplete need not change every task. A small, obvious edit may be quicker to make directly. Delegation earns its overhead when there is a meaningful sequence of investigation, modification and verification to hand over.

Where It Fails and What's Overhyped

The loop fails when its feedback cannot distinguish a correct solution from a plausible one. A green check can confirm formatting while saying nothing about tenant isolation, the separation of different customers' data. A passing mocked test can miss the integration that customers use. A convincing summary can omit a command that failed.

Context creates another limit. The agent may see the relevant function but miss the reason an unusual constraint exists. Put consequential decisions near the work, identify the authoritative specification and ask for uncertainty to be surfaced. Anthropic's documentation describes how long sessions manage finite context; do not assume an early conversational instruction remains equally salient throughout a large change. How Claude Code works.

More agents also create coordination work. If separate sessions modify the same files, interface or database state, a successful local result can still conflict with another change. Use separate checkouts and explicit integration ownership. Parallelize independent investigations before parallelizing tightly coupled implementation.

The wider failure is accepting complexity nobody intended to maintain. A new abstraction, dependency or background job becomes your operational responsibility even if generating it was easy. Ask whether the change solves the task with an appropriate amount of new machinery.

What Agentic Coding Benchmarks Do Not Establish

A coding benchmark does not, by itself, establish your team's delivery improvement. To apply a reported result, you would need to understand the tasks, repository context, tools, retry policy and definition of success. A vendor's productivity percentage is not a forecast for your codebase.

For your own pilot, record elapsed time to an accepted change, reviewer effort, rework, defects found after merge and blocked runs. Compare similar task types and preserve the failures in the record. This is a proposed measurement plan; no percentage improvement is claimed here.

Expand delegation when accepted work becomes easier to deliver without an unacceptable rise in review burden or defects. If producing patches gets faster while understanding them gets harder, reduce the scope and improve the evidence.

FAQ

The Monday Move

Choose one small backlog issue with reproducible behavior and assign its reviewer before starting the agent. Write the acceptance criteria, provide an isolated working environment and withhold production credentials. Ask for a patch plus the evidence needed to assess it.

After review, record what the agent handled, where a person intervened and which checks were missing. Use that evidence to choose the next task's scope. Increase autonomy when the verification process earns it.

For practical notes on building with AI, join the newsletter.