5 AI Agent Failure Modes That SDD 2.0 Blocks Architecturally

Plausible bullshit, the single-agent ceiling, and spec drift — what the three pillars of Objective-Validation Development actually block.

“If you can’t describe what you are doing as a process, you don’t know what you’re doing.” — W. Edwards Deming, Statistician

The industry keeps repeating that AI agents generate code at lightning speed, and that’s enough. In December 2025, one agent was granted permissions to fix a production AWS environment and spent thirteen hours deleting the Cost Explorer deployment in the China region. That wasn’t an edge case — it was an exposed failure mode of every LLM working without automated quality gates: shell hallucination, plausible bullshit, and no audit trail.

This affects everyone deploying Claude Code, Cursor, or Kiro in environments where compliance is a product, not a cost. The Kiro China incident showed that the problem isn’t which model you choose — it’s the pipeline topology.

Over the next ten minutes, you’ll see the architectural response to that problem — five concrete LLM failure modes and three SDD 2.0 pillars that block each one, plus a clear boundary for when this level of rigor is worth the cost.

Quick Win — The Anatomy of Three Pillars in One Paragraph

SDD 2.0 — also known as Objective-Validation Development — is an architectural response to five recurring AI agent failure modes.

• First mode: API hallucination — the agent generates calls to nonexistent endpoints.
• Second mode: spec drift — code and specification diverge after a few iterations.
• Third mode: the single-agent ceiling — early SDD tools consumed more than 90% of the context window in popular IDEs before the model wrote its first line.
• Fourth mode: plausible bullshit — the agent claims a feature works when the code has no tests.
• Fifth mode: autonomous destructive decisions — the Kiro China incident of December 2025 is their logical extreme.

SDD 2.0 blocks each of these modes with a different architectural layer.

• First pillar: Objective-Validation replaces manual code review with automated quality gates.
• Second pillar: multi-agent workflows break a single overloaded LLM into a brigade of specialists — Spec Agent, Plan Agent, Code Agent, and Validate Agent.
• Third pillar: the business-intent layer lets a product owner write intent in natural language, which AI translates into a specification in EARS notation.

This isn’t ceremony. It’s an engineering response to the unreliability of a stochastic compiler. With that established, let’s open up the mechanism.

Diagnosis: The Single-Agent Ceiling and Plausible Bullshit

Let’s step back a year. On February 2, 2025, Andrej Karpathy coined the term vibe coding — prompting an agent without structure, relying on intuition and the hope that the code would work. Karpathy himself qualified it as “not too bad for throwaway weekend projects, but still quite amusing.” The industry treated that qualified mode as a universal standard and hit a wall.

That wall has a concrete name: plausible bullshit — the failure mode in which code looks syntactically correct but hallucinates APIs, violates contracts, and ignores edge cases. An agent calls endpoints that don’t exist in the OpenAPI spec, invents methods from nonexistent libraries, and claims a feature works when the code has no tests. Spec-Kit Agents (Taghavi and Bhavani, arXiv 2026) formally described this as “context blindness” in large, evolving repositories.

The first attempt at an answer was classic SDD 1.0 — an early proto-SDD workflow from 2024: three versioned Markdowns fed to a single agent. A sound intuition built on a flawed assumption: that one LLM could carry the roles of analyst, architect, developer, and tester simultaneously. Each of those roles requires a different context and different validation.

The Context Ceiling and the Figma Experiment

A single agent didn’t have the bandwidth for that — and the bottleneck is the context window. Early SDD tools consumed more than 90% of the context window in popular IDEs before the model wrote a single line. That’s the context tax — tokens eaten by environment commands before the agent started working.

The operational impact was documented in comparative benchmarks: single agents showed significantly higher failure rates and longer run times than multi-agent architectures on tasks requiring full API contract knowledge.

The single-agent ceiling isn’t a problem to work around — it’s a structural limit to accept. If your team is dealing with agents that “understand everything” but PRs keep showing fabricated APIs — you don’t need a better prompt. Your pipeline topology is poorly designed. SDD 2.0 doesn’t fix the single agent. It replaces the entire architecture of how code gets built.

SDD 1.0 required one LLM to be an analyst, architect, developer, and tester. SDD 2.0 breaks that into four roles.

First Pillar — The Inspector with a Machine-Readable Matrix

“Perfection is achieved not when there is nothing more to add, but when there is nothing left to take away.” — Antoine de Saint-Exupéry, Writer

Objective-Validation — automated quality gates that parse the spec and block code violating contracts — is the heart of SDD 2.0. Manual code review for spec compliance was a human compiler — an economic and cognitive mistake. A person should review business decisions, not check whether an agent violated the data access layer. Objective-Validation moves that work from an architect’s brain to CI.

The mechanics have four phases. You parse the spec into machine assertions. You derive the contract — interfaces, types, and business rules. You instantiate a test harness automatically from the contract. You verify the implementation in CI, blocking the PR when the harness fails.

Three Validation Planes

The inspector works across three planes, operating independently and in parallel. Each blocks a different failure mode.

• Architecture tests — static analysis verifying that code doesn’t violate layer boundaries. ArchUnit for Java, Dependency Cruiser for TypeScript, NetArchTest for .NET. An AI agent attempting a shortcut — a direct DB call from the presentation layer — gets rejected at commit time, before a human sees the code.
• Conformance testing — validation that code conforms to the API contract defined in the spec. Specmatic, Pact. When an agent changes a userId type from string to integer, the gate blocks the merge — no negotiation, no question.
• Security gates — rule-as-code, OWASP, mapping to ISO 26262, HIPAA, PCI-DSS. The gates scan for SQL injections, hardcoded secrets, and missing idempotency keys in payment endpoints.

Above all of this sits the project constitution — the constitution.md pattern from the leading 2026 tools, a file containing overriding principles injected into every agent session. Immutable across iterations. The agent doesn't negotiate with the constitution — it consumes it.

What Independent Measurements Show

The numbers are more modest than we’d like. Spec Kit Agents (Taghavi and Bhavani, 2026) independently measured an improvement of +0.15 on a five-point quality scale (+3% of the full score) across 128 runs at 99.7–100% test compatibility. That’s a rigorous, statistically significant (Wilcoxon p<0.05) figure — and it’s an order of magnitude smaller than vendor-marketed claims.

In security, banking-sector firms report significant reductions in vulnerabilities after introducing constitutional constraints in the spec for payment endpoints — the 73% figure appears in unpublished 2026 case studies that can’t be independently verified. I treat it as a directional signal, not an auditable citation.

The practical consequence: your senior architect stops reading PRs looking for layer violations. They start reviewing the spec — higher up the value chain. The inspector checks the walls — but someone has to build the building. SDD 2.0 doesn’t hire one carpenter; it hires a brigade.

Spec.md parsed into machine contracts, three gates blocking code that violates architecture, API contract, or security rules.

Second Pillar — A Brigade of Specialists Instead of One Agent

Decomposition isn’t a cost optimization — it’s an architectural decision that an agent should have a role, not an identity. A Spec Agent isn’t a “better” agent than a Code Agent — it’s an agent with a different constitutional prompt, a different context, and a different responsibility. Distributed responsibility is bad responsibility.

Four Roles, Four Contexts

Multi-agent workflows — distributing work across specialized agents with isolated contexts and hard handoffs — look like this:

• Spec Agent takes the intent, runs clarification, and produces spec.md in EARS notation.
• Plan Agent breaks the spec into atomic tasks in isolated git worktrees.
• Code Agent receives one task at a time, in a clean context, without the noise of the rest of the project.
• Validate Agent runs the quality gates from Pillar 1 and either lets the task through to merge or sends it back.

The handoff protocol — where the output of one agent becomes the blocked input of the next — is critical. An agent’s result is a versioned Markdown artifact. Modification doesn’t happen inline — it requires returning upstream. The Code Agent doesn’t fix the spec — it goes back to the Spec Agent.

In commercial frameworks, roles have names. BMAD-METHOD uses personas (Amelia, Quinn, Winston, Mary). InsaneSDD — a community framework inspired by BMAD — breaks the pipeline into five roles: BA, PM, Architect, Developer, and QA.

What Independent Measurements Show

Spec Kit Agents (arXiv 2604.05278, 2026) — 128 runs, 32 features, 5 repositories — show +0.15/5 quality at 99.7–100% test compatibility. Rigorous, but modest.

The counterpoint is equally concrete. Colin Eberhardt, CTO at Scott Logic, measured his own KartLog project. Vibe coding — 32 minutes total for a CRUD feature. Spec Kit — 4 hours total for a comparable feature. “I am a lot more productive without SDD, around ten times faster” — that’s a direct quote from his blog about the KartLog project, where GitHub commits confirm Spec Kit integration and the accompanying increase in specification complexity. That counterpoint doesn’t disappear — we discuss the boundary in section six.

The practical consequence: when a team adopts multi-agent SDD, the first alarm from the senior architect is “that Plan Agent proposed a different decomposition than I would have”. Decomposition stops being the architect’s work — it becomes a validated artifact. The architect reviews the plan; they don’t write it. The brigade builds efficiently. But someone still has to say what to build.

Multi-agent SDD 2.0: four roles, four contexts, four handoffs as versioned Markdown artifacts.

Third Pillar — The Design Office Translates Business Intent

The business-intent layer — where a product owner writes intent in natural language and AI generates a full specification — is the only part of SDD 2.0 that genuinely scales an organization. The first two pillars optimize the work of technical teams. The third pulls business-engineering communication out of the broken-telephone game of Jira tickets. This doesn’t eliminate the business analyst — it shifts them from “requirements translator” to “intent validator”.

The mechanics rest on Context Layering — three dimensions of context that AI consults before generating a spec.

• System Context is the project constitution — OAuth, GDPR, the stack.
• Feature Context is API contracts, database models, user stories.
• Execution Context is the repository state and environment configurations.

When a product owner writes “block access after three failed attempts”, the Spec Agent generates acceptance criteria in EARS notation — Easy Approach to Requirements Syntax, five standardized sentence patterns used in the leading SDD tools such as Kiro and Spec-Kit.

Adoption and an Honest Counterpoint

Adoption is documented. A major airline, working with AWS, announced at re:Invent 2025 significant growth in Q Developer adoption over six months and 94% CSAT, with product owners generating production prototypes without developers. The specific percentage figure comes from a re:Invent session whose full transcript isn’t publicly available — I treat it as a trend signal, not a certified statistic.

A contrarian perspective from a French software house points to the weakness: “a business user writes three sentences, an engineer spends an hour reworking them, the business clicks Approve without reading”. Garbage-in-garbage-out doesn’t disappear — it just moves to a different layer.

The practical consequence: the business-intent layer determines whether the project truly scales or merely changes job titles. Pilot it last — the first two pillars will show you whether the foundation works. The three pillars stand. The question is whether this building is for everyone.

Intent passes through three context layers and exits as a machine-readable EARS specification.

Banking, Healthcare, Embedded — Where SDD 2.0 Became the Standard

Regulated verticals didn’t choose SDD 2.0 because it’s fashionable. They chose it because an executable, versioned spec solves a specific regulator problem: not “is your code good”, but “prove that your code complies with the standard in a way an auditor can verify without reading the code itself”. The spec becomes evidence. The audit trail in git replaces folders of Word documents.

Three Verticals, Three Drivers

• In banking, constitutional constraints in the spec for payment endpoints produce measurable security effects — regardless of what specific number sits behind “significant reduction.” Idempotency keys for POST /charges become a contract — an agent attempting to implement naive logic that would duplicate charges on retry is blocked before the merge. The PCI-DSS traceability matrix is generated as a byproduct, not additional effort.
• In healthcare, the contract is regulation. HIPAA and HL7 FHIR are mapped as acceptance criteria. An agent generating a function that exposes PHI outside the authorized structure fails the build automatically. Quoting a 2026 case study: “Healthcare can’t afford vibe coding — one hallucinated function in a medication dosing module isn’t a bug, it’s a liability.”
• In embedded, we’re talking about fleets. An operator of a large network fleet has tens of thousands of devices and hundreds of millions of pipeline runs per year. Even a one-percent variance in a log parser translates into hundreds of thousands of inconsistent measurements and real labor costs. “Golden briefs” — locked, validated specs — are the only mechanism holding a probabilistic agent at the infrastructure boundary.

Above all of this sits the regulatory forcing function. The EU AI Act — high-risk obligations take effect August 2, 2026, with penalties up to 15 million euros or 3% of global annual turnover. The spec becomes a form of auditable evidence by construction — this isn’t marketing, it’s a legal requirement. Meanwhile, DeepLearning.AI launched the “Spec-Driven Development with Coding Agents” course on April 15, 2026, led by a developer advocate from JetBrains.

The Answer to the Facts-First Objection

The contrarian position from previous episodes of the SDD arc holds that LLMs don’t retain knowledge, so facts should live in graph databases outside the model. SDD 2.0 absorbs that argument rather than fighting it — an executable spec is exactly that kind of fact: versioned, deterministic, regenerable.

An architectural pattern from late 2025 captures this vividly: “code is designed to die and be reborn — spec is the identity that survives the fire”. The spec outlives the model upgrade. You switch from Claude 4 to Claude 5 — you regenerate the code, the spec stays.

The practical consequence: if your compliance officer asks “how do we prove to an auditor that AI didn’t introduce a violation”, the answer “we have senior code review” stopped being sufficient in 2026. An executable spec plus an audit trail in git is today’s minimum. SDD 2.0 won in banking. The question is whether every project is a bank.

SDD 2.0 the enterprise default where auditability is the product. Drivers: PCI-DSS, HIPAA, ISO 26262 — and the EU AI Act, August 2, 2026.

The Boundary — When SDD 2.0 Slows You Down Instead of Speeding You Up

The worst thing you could do with SDD 2.0 is deploy it in a five-person startup building an MVP. There, vibe coding is right, Eberhardt is right, the French software house is right. SDD 2.0 isn’t a universal pipeline — it’s an architecture for domains where the bug-fix cycle is long, audit is a product, and a mistake costs more than the ceremony.

Spec ceremony tax — the time overhead of writing a structured spec before writing code — is real. Eberhardt’s measurement is uncomfortable but unambiguous: for 689 lines of CRUD code produced with Spec Kit, 2,577 lines of Markdown were written. For small greenfield teams, Spec Kit is overhead that doesn’t pay for itself in validation gains.

The decision comes down to four dimensions: regulated project, multi-person team, brownfield environment, and audited compliance.

Three or more “yes” — deploy it. Two or fewer — stay on CLAUDE.md and reassess in a year.

The second ordering threshold is about expectations. The independently measured improvement is +3% quality from Spec Kit Agents, not the 50–70% from vendor-marketed messaging. You make the decision based on concrete verticals where local measurements make sense — not a global marketing score.

Back to the Failure: What the Architecture Changes

Let’s return to the Kiro China incident. An agent was given permissions. It hallucinated a shell command. It deleted a deployment. Thirteen hours of downtime.

That same pipeline with the three SDD 2.0 pillars would have stopped it architecturally.

• Pillar one would have blocked the deployment-deleting script — the security gate would have contained a rule: no agent has permissions for destructive operations on production without human-in-the-loop approval.
• Pillar two would have injected a Validate Agent between the Code Agent and execution — with a narrow responsibility: block destructive shell commands.
• Pillar three would have freed the business intent from engineering ambiguity — “fix the system” isn’t a spec; “fix the system without modifying deployment infrastructure” — that’s a spec.

Five failure modes, three pillars, one executable spec as the single source of truth. The pilot is one team, one brownfield project in a regulated sector, one quarter. You measure the spec ceremony tax and the defect rate. The company-wide decision follows from data, not from enthusiasm.

An executable spec is a fact, not a document — versioned, regenerable, and surviving the model upgrade. It’s the architectural answer to the facts-first objection.

Three pillars blocking five LLM failure modes, foundation in regulated verticals, forcing function the EU AI Act August 2, 2026.

Closing

Thank you for the ten minutes you spent breaking down this architecture. If this article changed how you think about piloting SDD 2.0 in your team — share it with someone who should know this before their next quarterly architecture review. In the comments, leave your production gotcha: which of the five failure modes you’ve seen in your own environment, and what in the pipeline turned out not to block it.

Plausible bullshit didn’t disappear. It just got an inspector.