# Agents and workflows

> The AI agents that run in an AI CodeOps session and the 16 built-in workflows that order them, from Plan, Build, Review & Test to Incident Response.

Source: https://aicodeops.dev/docs/agents

A session isn't one AI model answering one prompt. It is a **workflow**: a fixed sequence of steps, each run by an **agent** with its own role and instructions. Planning, building, reviewing and testing are done by different agents, so the work is checked by something other than the thing that wrote it.

## The built-in agents

| Agent              | Role                                    |
| ------------------ | --------------------------------------- |
| Architect          | Plans, risks, staged execution.         |
| Builder            | Implements approved changes.            |
| Reviewer           | Correctness and maintainability review. |
| Tester             | Tests, typecheck and quality gates.     |
| Security Auditor   | Security risks, secrets, CVEs.          |
| UI Designer        | Visual and UX planning.                 |
| DevOps Engineer    | CI/CD, infrastructure, pipelines.       |
| Product Analyst    | Requirements and acceptance criteria.   |
| Project Planner    | Phased delivery plans.                  |
| Researcher         | Prior art and codebase survey.          |
| Backend Engineer   | Server-side implementation.             |
| Frontend Engineer  | Client-side implementation.             |
| E2E Tester         | End-to-end test coverage.               |
| Dependency Auditor | Supply-chain audit.                     |
| Database Engineer  | Schema and migration design.            |
| Incident Responder | Incident triage.                        |
| Site Reliability   | SLOs, runbooks, postmortems.            |
| ADR Writer         | Architecture decision records.          |

Some workflows also use a technical writer, a migration specialist and a performance tester. More about each agent is on the [agents page](https://aicodeops.dev/agents).

## The built-in workflows

Pick a workflow in the **Workflow** list when you [start a session](https://aicodeops.dev/docs/sessions). **Develop → Workflows** shows the full catalog.

| Workflow                                 | Steps                                                                                                          |
| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| **Plan, Build, Review & Test** (default) | Plan → Build → Review → Test                                                                                   |
| **Quality-Gated Change**                 | Build → Test → Review                                                                                          |
| **Security-Sensitive Change**            | Scope change → Risk analysis → Implement → Audit diff → Validate                                               |
| **Parallel Review**                      | Correctness, security and test-coverage reviews, one after another, then findings merged                       |
| **UI Implementation**                    | UI plan → Implement → Code review → Behavior test                                                              |
| **DevOps Change**                        | DevOps plan → Risk review → Apply → Validate                                                                   |
| **Feature SDLC**                         | Requirements → Delivery plan → Technical design → Backend → Frontend → E2E tests → Security review → User docs |
| **Discovery & Spec**                     | Prior art → Requirements → Delivery plan (no code)                                                             |
| **Architecture Debate**                  | Two architects propose, a reviewer critiques, the architect synthesises                                        |
| **Threat Model**                         | Scope and data flow → STRIDE analysis → Record ADR                                                             |
| **Swarm Inspection**                     | Review, security and test slices across the codebase, then a merged summary                                    |
| **Release Readiness**                    | Review, security, E2E sanity and dependency audit, then a go/no-go                                             |
| **Incident Response**                    | Triage → Root cause → Mitigation → Verify → Postmortem                                                         |
| **Dependency Refresh**                   | Audit → Upgrade → Test → Security re-check                                                                     |
| **Performance Tuning**                   | Profile → Optimization plan → Apply → Re-measure                                                               |
| **Data Migration**                       | Schema → Migration → Validate → Security → Final review                                                        |

Architecture Debate, Discovery & Spec and Threat Model record an architecture decision record (ADR) you can find under **Plan → ADRs**.

## What happens after the agents finish

Whatever the workflow, a session that writes code goes through the same checks: your project's tests run against the change, an AI review records findings, and a person approves it before a pull request opens. See [Quality gates](https://aicodeops.dev/docs/quality-gates).

## Models per step

On the platform's models with **Auto**, each step gets the tier that suits it: steering steps (architect, reviewer, security auditor, researcher, planners) get the best tier you have allowance for, code-writing gets Standard, and drafting gets Economy. See [Models and tiers](https://aicodeops.dev/docs/models).

## Custom agents and skills

Under **Configure → Agents**, choose **New agent** to define your own agent: its model, permissions and prompt. Under **Configure → Skills** you find reusable instructions agents can apply, such as Security Review, Test Generation, Refactor, Migration and Documentation.

Policies can limit which agents and workflows run without approval. See [Approvals and policies](https://aicodeops.dev/docs/approvals-and-policies).

## Next steps

- [Start a session](https://aicodeops.dev/docs/sessions)
- [Quality gates](https://aicodeops.dev/docs/quality-gates)
- [All agents](https://aicodeops.dev/agents)

## Frequently asked questions

### Which workflow should I start with?

Plan, Build, Review & Test. It is the default and suits most code changes. Pick a specialised workflow when the task is clearly security, UI, infrastructure, data or incident work.

### Can I add my own agents?

Yes, for the built-in roles. Under Configure → Agents you can give an agent your own prompt, model and permissions; it takes effect where a workflow step uses that agent. Workflows themselves can't be customised yet, so an agent for a brand-new role isn't run.