# AI for Engineering & Software URL: https://justuju.org/role/engineering/ For your role Software is the profession AI has changed most. Agents now read a codebase, edit many files, run the tests and open the pull request. The engineer's job tilts toward specifying, reviewing and owning the system around the model. ## How AI is changing this work - Coding agents take a task from issue to pull request, in your terminal, your editor or the cloud. - Review becomes the bottleneck: more code arrives than before, and someone must still understand it. - Building with models is ordinary engineering now: tools, tests, cost, latency and failure modes. ## Key layers, most important first ### 1. Layer 8 · Agents URL: https://justuju.org/layer/agents/ Why it matters: This is where your daily work changed. An agent is a model in a loop with tools; how well it does depends on the harness, the permissions and the task you hand it. What to do here: - Issue to pull request: Hand a well-scoped task to an agent, let it run tests, and review the diff like any colleague's. (see https://justuju.org/concept/coding-agents/) - Sandbox by default: Run agents with file and network limits, and approve the risky commands yourself. (see https://justuju.org/concept/agent-permissions/) - Parallel agents: Split independent tasks across agents; keep one owner for the merge. (see https://justuju.org/concept/multi-agent/) - Know the harness: The loop, tools and context handling around the model explain most differences between agents. (see https://justuju.org/concept/agent-harnesses/) Examples as of 2026-11-11: Claude Code (https://code.claude.com/docs/en/overview); OpenAI Codex (https://developers.openai.com/codex/concepts/sandboxing); Cursor (https://cursor.com/docs/agent/overview); GitHub Copilot cloud agent (https://github.com/features/copilot) ### 2. Layer 7 · Orchestration & Tooling URL: https://justuju.org/layer/orchestration-tooling/ Why it matters: Whether you use agents or build AI features, quality is decided here: what context the model sees, which tools it can call and which tests catch regressions. What to do here: - Tools over a standard protocol: Expose internal systems to agents once, through a tool server, instead of per-app glue. (see https://justuju.org/concept/tool-use/) - Instruction files: Keep build commands, conventions and pitfalls in a repo file the agent reads every time. (see https://justuju.org/concept/context-engineering/) - Evals in CI: Treat prompts like code: a test set that runs on every change and blocks regressions. (see https://justuju.org/concept/guardrails-evals/) - Untrusted input stays data: Anything an agent reads, such as issues, web pages or tool output, can carry instructions. (see https://justuju.org/concept/prompt-injection/) Examples as of 2026-11-11: Model Context Protocol (MCP) (https://modelcontextprotocol.io/specification/2026-07-28/); LangSmith (LangChain) (https://www.langchain.com/langsmith/evaluation); Braintrust (https://www.braintrust.dev/) ### 3. Layer 6 · Inference & Optimization URL: https://justuju.org/layer/inference-optimization/ Why it matters: Every model call has a price, a wait and a rate limit. Routing, caching and where the model runs are engineering decisions with large effects. What to do here: - One interface, many models: Put a router or gateway in front so you can switch models without rewriting. (see https://justuju.org/concept/model-apis/) - Prompt caching: Keep the stable prefix stable and cache it; agents re-send it on every step. (see https://justuju.org/concept/batching-caching/) - Local for private or offline work: Run an open model on your own machine when code may not leave it. (see https://justuju.org/concept/local-inference/) Examples as of 2026-11-11: OpenRouter (https://openrouter.ai/docs/quickstart); Amazon Bedrock (https://aws.amazon.com/bedrock/); Ollama (https://docs.ollama.com/api/openai-compatibility); vLLM (https://github.com/vllm-project/vllm) ### 4. Layer 5 · Foundation Models URL: https://justuju.org/layer/foundation-models/ Why it matters: You do not need to train models, but knowing how they work explains their behaviour: context limits, token costs, why they invent APIs and when extra thinking helps. What to do here: - Thinking on demand: Turn on extended reasoning for design and debugging; turn it off for simple edits. (see https://justuju.org/concept/reasoning-models/) - Tokens are the unit: Limits, speed and price are all counted in tokens, not characters or lines. (see https://justuju.org/concept/tokenization/) - Open or closed: Open weights give control and privacy; closed models usually lead on the hardest tasks. (see https://justuju.org/concept/open-weights/) Examples as of 2026-11-11: Claude extended thinking (https://platform.claude.com/docs/en/build-with-claude/extended-thinking); DeepSeek-R1 (open weights) (https://huggingface.co/deepseek-ai/DeepSeek-R1) ### 5. Layer 9 · Applications & Interfaces URL: https://justuju.org/layer/applications-interfaces/ Why it matters: The assistant in your editor and your chat window is still where most quick questions go. It is the lightest way to use AI and the easiest to over-trust. What to do here: - Inline completion and chat: Use it for boilerplate, tests and unfamiliar APIs, and read what it writes. (see https://justuju.org/concept/copilots/) - Explain before you change: Ask for a walkthrough of unfamiliar code before asking for edits. (see https://justuju.org/concept/chat-assistants/) Examples as of 2026-11-11: GitHub Copilot (https://github.com/features/copilot) ## High-leverage use cases - Scoped tasks to agents: Bug fixes, tests, migrations and upgrades with a clear definition of done. - Codebase questions: Ask how a system works and get an answer with file references. - Test and doc coverage: Generate missing tests and documentation, then review them. - Internal tools as agent tools: Expose deploy, logs and tickets to agents through one tool server with permissions. - Review assistance: A first-pass review for bugs and risky changes before a human reviewer. ## Start here: the next 30 to 60 days - Week 1 to 2: Write an agent instruction file for one repo: how to build, test and what never to touch. - Week 3 to 4: Give an agent ten small real tickets. Record which succeeded, which failed and why. - Day 30 to 60: Set team rules: sandbox settings, which commands need approval, and that the author owns agent-written code. - Day 30 to 60: Connect one internal system as a tool, with read-only access first. ## Risks and pitfalls - Feeling faster than you are: In one controlled study, experienced developers on their own projects were slower with AI tools while believing they were faster. Measure on your own work. Source: https://arxiv.org/abs/2507.09089 - Insecure generated code: A study of assistant-written code found a large share of security-relevant completions were vulnerable. Review and scan as you would any code. Source: https://arxiv.org/abs/2108.09293 - Agents with broad access: An agent with your credentials can delete, push and deploy. Sandbox it and keep approvals on destructive actions. Source: https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/ - Instructions hidden in content: A comment in an issue or a web page can redirect an agent that reads it. Source: https://genai.owasp.org/llm-top-10/ - Code nobody understands: Merged code still needs an owner who can explain it. Keep pull requests small enough to review. ## Sources - Claude Code (code.claude.com): https://code.claude.com/docs/en/overview - OpenAI Codex (developers.openai.com): https://developers.openai.com/codex/concepts/sandboxing - Cursor (cursor.com): https://cursor.com/docs/agent/overview - GitHub Copilot cloud agent (github.com): https://github.com/features/copilot - Model Context Protocol (MCP) (modelcontextprotocol.io): https://modelcontextprotocol.io/specification/2026-07-28/ - LangSmith (LangChain) (langchain.com): https://www.langchain.com/langsmith/evaluation - Braintrust (braintrust.dev): https://www.braintrust.dev/ - OpenRouter (openrouter.ai): https://openrouter.ai/docs/quickstart - Amazon Bedrock (aws.amazon.com): https://aws.amazon.com/bedrock/ - Ollama (docs.ollama.com): https://docs.ollama.com/api/openai-compatibility - vLLM (github.com): https://github.com/vllm-project/vllm - Claude extended thinking (platform.claude.com): https://platform.claude.com/docs/en/build-with-claude/extended-thinking - DeepSeek-R1 (open weights) (huggingface.co): https://huggingface.co/deepseek-ai/DeepSeek-R1 - Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity (METR): https://arxiv.org/abs/2507.09089 - Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions: https://arxiv.org/abs/2108.09293 - OWASP Top 10 for Agentic Applications: https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/ - OWASP Top 10 for LLM Applications: https://genai.owasp.org/llm-top-10/ --- Justuju · https://justuju.org/ · Content CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Quote with a link to the page.