Agents and workflows
The AI agents that run in an AI CodeOps session and the 16 built-in workflows that order them, from Plan, Build, Review & Test to Incident Response.
A session isn't one AI model answering one prompt. It is a workflow: a fixed sequence of steps, each run by an agent with its own role and instructions. Planning, building, reviewing and testing are done by different agents, so the work is checked by something other than the thing that wrote it.
The built-in agents
| Agent | Role |
|---|---|
| Architect | Plans, risks, staged execution. |
| Builder | Implements approved changes. |
| Reviewer | Correctness and maintainability review. |
| Tester | Tests, typecheck and quality gates. |
| Security Auditor | Security risks, secrets, CVEs. |
| UI Designer | Visual and UX planning. |
| DevOps Engineer | CI/CD, infrastructure, pipelines. |
| Product Analyst | Requirements and acceptance criteria. |
| Project Planner | Phased delivery plans. |
| Researcher | Prior art and codebase survey. |
| Backend Engineer | Server-side implementation. |
| Frontend Engineer | Client-side implementation. |
| E2E Tester | End-to-end test coverage. |
| Dependency Auditor | Supply-chain audit. |
| Database Engineer | Schema and migration design. |
| Incident Responder | Incident triage. |
| Site Reliability | SLOs, runbooks, postmortems. |
| ADR Writer | Architecture decision records. |
Some workflows also use a technical writer, a migration specialist and a performance tester. More about each agent is on the agents page.
The built-in workflows
Pick a workflow in the Workflow list when you start a session. Develop → Workflows shows the full catalog.
| Workflow | Steps |
|---|---|
| Plan, Build, Review & Test (default) | Plan → Build → Review → Test |
| Quality-Gated Change | Build → Test → Review |
| Security-Sensitive Change | Scope change → Risk analysis → Implement → Audit diff → Validate |
| Parallel Review | Correctness, security and test-coverage reviews, one after another, then findings merged |
| UI Implementation | UI plan → Implement → Code review → Behavior test |
| DevOps Change | DevOps plan → Risk review → Apply → Validate |
| Feature SDLC | Requirements → Delivery plan → Technical design → Backend → Frontend → E2E tests → Security review → User docs |
| Discovery & Spec | Prior art → Requirements → Delivery plan (no code) |
| Architecture Debate | Two architects propose, a reviewer critiques, the architect synthesises |
| Threat Model | Scope and data flow → STRIDE analysis → Record ADR |
| Swarm Inspection | Review, security and test slices across the codebase, then a merged summary |
| Release Readiness | Review, security, E2E sanity and dependency audit, then a go/no-go |
| Incident Response | Triage → Root cause → Mitigation → Verify → Postmortem |
| Dependency Refresh | Audit → Upgrade → Test → Security re-check |
| Performance Tuning | Profile → Optimization plan → Apply → Re-measure |
| Data Migration | Schema → Migration → Validate → Security → Final review |
Architecture Debate, Discovery & Spec and Threat Model record an architecture decision record (ADR) you can find under Plan → ADRs.
What happens after the agents finish
Whatever the workflow, a session that writes code goes through the same checks: your project's tests run against the change, an AI review records findings, and a person approves it before a pull request opens. See Quality gates.
Models per step
On the platform's models with Auto, each step gets the tier that suits it: steering steps (architect, reviewer, security auditor, researcher, planners) get the best tier you have allowance for, code-writing gets Standard, and drafting gets Economy. See Models and tiers.
Custom agents and skills
Under Configure → Agents, choose New agent to define your own agent: its model, permissions and prompt. Under Configure → Skills you find reusable instructions agents can apply, such as Security Review, Test Generation, Refactor, Migration and Documentation.
Policies can limit which agents and workflows run without approval. See Approvals and policies.
Next steps
Frequently asked questions
Which workflow should I start with?
Plan, Build, Review & Test. It is the default and suits most code changes. Pick a specialised workflow when the task is clearly security, UI, infrastructure, data or incident work.
Can I add my own agents?
Yes, for the built-in roles. Under Configure → Agents you can give an agent your own prompt, model and permissions; it takes effect where a workflow step uses that agent. Workflows themselves can't be customised yet, so an agent for a brand-new role isn't run.