Agent-Authored App Governance Study
Independent Research (Auckland University of Technology) · Supervised by Richard Pamatatau
Holden Richard · University of Vermont
Working paper · November 2026 · Manuscript in preparation
A semester-long empirical case study of how one developer maintains control over software built with AI coding agents. Kabu, an iOS financial-literacy app, was the primary testbed; the research record also spans other projects.
- ledger entries
- 628
- 280 defects · 348 near misses
- session logs
- 171
- Across the study’s projects
- ledger columns
- 18
- Failure class, detection, remedy and provenance
Analysis snapshot: October 16, 2026. Collection continued afterward; these counts describe the frozen analysis.
Governance beyond authorship
Delegating implementation left the developer responsible for verifying the system’s behavior and deciding what agents could do.
Failures becoming controls
Recorded incidents prompted written rules and machine-checkable safeguards. Controls were tested against deliberately broken inputs before being trusted.
The boundary of automation
Some decisions could become repeatable checks. Others still depended on interpretation and human judgment, especially when an external decision’s basis was unclear.
Engineering artifact
A 372-line Python integrity gate checks the research records on every push through GitHub Actions. Deliberately broken inputs were used to verify that its checks actually fail. It validates the record’s consistency, rather than certifying the app’s security or architecture.
This is a single-developer case study, not a population estimate or evidence that repeat failures were eliminated.