A clear spec first, then AI writes
AI does exactly what is written — including the gaps and the vague parts. So requirements pass the Spec Fidelity gate (complete, consistent, unambiguous, verifiable) before they are used to generate code or tests.
Process
Clear steps. Tangible handovers.
From the first conversation to a running product. Explore 7 phases to see who owns the work, what you receive and when it is ready to move forward.
Discover
00Intake & first consultation
Log the request as a numbered ticket and understand the problem and why it matters now — before promising anything.
3 deliverables · View detailsPresales & qualification
Decide whether to pursue the project against written criteria — need, budget, authority, timeline, capability, risk — and say "no" early when it is not a fit.
4 deliverables · View detailsDiscovery & business analysis
Map the client’s current workflow, find the real pain points and decide what the software will and will not touch.
3 deliverables · View detailsExplore 21 stages in 3D
View the full sequence and improvement loop
Sequence
7 phases, in order
Stage 19 (Continuous improvement) loops back to stage 3 (Solution proposal & estimate): every major improvement starts again from a proposal, with its own scope and quality gates.
- DiscoverPhase 1/7
- 00
Intake & first consultation
Request form · first call
Log the request as a numbered ticket and understand the problem and why it matters now — before promising anything.
3 deliverables · 2 templates
- 01
Presales & qualification
Scorecard · go / no-go
Decide whether to pursue the project against written criteria — need, budget, authority, timeline, capability, risk — and say "no" early when it is not a fit.
4 deliverables · 2 templates
- 02
Discovery & business analysis
Map how work is done today
Map the client’s current workflow, find the real pain points and decide what the software will and will not touch.
3 deliverables · 1 templates
- DefinePhase 2/7
- 03
Solution proposal & estimate
Options · WBS · estimate
Propose a concrete approach (usually 2–3 options), an honest estimate with its uncertainty and a milestone plan — enough for the client to make an investment decision.
4 deliverables · 2 templates
- 04
Contract, legal & kick-off
MSA · SOW · IP · kick-off
Settle the legal and financial frame before work starts: who owns what, which milestones are paid, how acceptance works, how data is handled — then kick off with the right people.
5 deliverables · 5 templates
- 05
Requirements specification
SRS · user stories · AC
Turn wishes into verifiable requirements: who does what, under which conditions, and what counts as "done".
4 deliverables · 3 templates
- DesignPhase 3/7
- 06
UX/UI design
Wireframes · prototype
Let the client "touch" the product before any code: clear flows, consistent UI, usable on phones and with assistive tech.
4 deliverables · 1 templates
- 07
Architecture & technical design
SDD · ERD · API · ADR
Decide how the system is split, where data lives, how parts talk to each other — and write down why.
5 deliverables · 2 templates
- BuildPhase 4/7
- 08
Planning & project setup
Sprints · repo · CI/CD
Lay the rails before running the train: a baselined plan, repository, automated checks, three separate environments and a reporting rhythm.
4 deliverables · 4 templates
- 09
Development
BE · FE · mobile · AI
Ship working software in thin slices — something the client can click every sprint, every line reviewed.
4 deliverables · 3 templates
- 10
Data migration
Mapping · rehearsal · reconciliation
Move data from the old system to the new one completely, correctly and lawfully — rehearsed several times before the real day, always with a way back.
4 deliverables · 1 templates
- VerifyPhase 5/7
- 11
Testing
Unit → system → load
Find defects before the client does — at every level, automating what repeats, with measurable coverage.
3 deliverables · 3 templates
- 12
Security
ASVS · scans · secrets
Security is a requirement, not decoration: verify against a checklist, scan automatically, never leak secrets, and handle personal data lawfully.
4 deliverables · 1 templates
- 13
Infrastructure, network & DevOps
DNS · TLS · CDN · monitoring
Prepare where the product will live: domain, certificates, CDN, containers, monitoring and backups — reproducible from code.
4 deliverables · 1 templates
- ShipPhase 6/7
- 14
UAT & acceptance
Client tests & signs
The client verifies the product against the acceptance criteria signed during Requirements specification — not against gut feeling.
3 deliverables · 2 templates
- 15
Release management
SemVer · notes · rollback
Every release has a number, contents, an approver and a way back — so you always know exactly what is running and can roll back in minutes.
4 deliverables · 2 templates
- 16
Go-live & handover
Go-live · training · accounts
Go to production safely with a rollback path, then hand over everything the client needs to own the product.
4 deliverables · 3 templates
- 17
Project closure
Retro · archive · revoke access
End the project deliberately: confirm every obligation is met, capture lessons, archive records, revoke access and settle accounts — instead of letting it fade out.
4 deliverables · 3 templates
- RunPhase 7/7
- 18
Warranty, operations & maintenance
SLA · incidents · updates
Keep the product healthy after handover: fix defects under warranty, handle incidents by the book, patch regularly.
3 deliverables · 3 templates
- 19
Continuous improvement
Data → v2
Use real data and feedback to decide what comes next — instead of adding features on a hunch.
3 deliverables · 2 templates
- 20
Decommissioning & exit
Return data · lawful deletion
When the system reaches end of life or the client changes supplier: return data in a usable format, hand over cleanly, delete personal data lawfully with evidence — and leave no orphaned servers.
4 deliverables · 1 templates
Reference frameworks
Real standards, cited by their exact designation
The process cites 62 standards, laws and practices. They are references for doing the work right — the studio claims no certification against any of them.
| Framework | Used for | Stages |
|---|---|---|
| ISO/IEC/IEEE 12207:2017 | Software life-cycle framework: process groups from agreement to retirement. | 01031620 |
| PMI — PMBOK® Guide | Project management: stakeholders, planning, estimation, closure. | 000317 |
| The Scrum Guide (2020) | Sprint cadence, roles and events during iterative delivery. | 08 |
| ISO/IEC 25010:2023 | Product quality model: writing measurable non-functional requirements. | 0514 |
| ISTQB® CTFL v4.0 | Testing vocabulary and process. | 1114 |
| OWASP ASVS | Application security verification before release. | 12 |
| Semantic Versioning 2.0.0 | Version numbering and release notes. | 1516 |
| ITIL® 4 | Release, deployment and incident management in operations. | 151618 |
| CMMI (ISACA) | Conceptual only — to self-assess process maturity, not a certification. | 17 |
| Luật Bảo vệ dữ liệu cá nhân 91/2025/QH15 + Nghị định 356/2025/NĐ-CP | Personal data protection: consent, notice, data-subject rights, deletion. | 0004101220 |
›All 62 references
- BANT (IBM)01
- Bộ luật Dân sự 2015 (91/2015/QH13)04
- Build–Measure–Learn (Lean Startup)19
- C4 model · ADR (M. Nygard)07
- CMMI (ISACA) — mức khái niệm17
- Conventional Commits 1.0.008
- Core Web Vitals (Google)19
- CWE Top 2512
- DAMA-DMBOK2 (DAMA International)10
- DORA metrics13, 15
- GitHub Flow / trunk-based09
- Google Engineering Practices — Code Review09
- Google SRE — SLI / SLO13
- IEEE 1016-200907
- IIBA — BABOK® Guide v302
- INVEST (Bill Wake)05
- ISO 21502:202000, 17
- ISO 31000:201808
- ISO 9241-210:201906
- ISO/IEC 25010:202305, 14
- ISO/IEC 25012:200810
- ISO/IEC 27001:2022 — Annex A 8.1020
- ISO/IEC 27001:2022 — Annex A 8.25–8.2809
- ISO/IEC 5230:2020 (OpenChain)04
- ISO/IEC/IEEE 12207:201701, 03, 16, 20
- ISO/IEC/IEEE 14764:202218
- ISO/IEC/IEEE 2911911
- ISO/IEC/IEEE 29148:201805
- ISO/IEC/IEEE 42010:202207
- ISTQB® — Acceptance testing14
- ISTQB® CTFL v4.011
- ITIL® 4 — Incident management18
- ITIL® 4 — Release & Deployment management16
- ITIL® 4 — Release management · Deployment management15
- Keep a Changelog 1.1.015
- Luật Bảo vệ dữ liệu cá nhân 2025 (91/2025/QH15)20
- Luật Bảo vệ dữ liệu cá nhân 2025 (91/2025/QH15) và Nghị định 356/2025/NĐ-CP00, 04, 10, 12
- Luật Giao dịch điện tử 2023 (20/2023/QH15)04
- Luật Sở hữu trí tuệ 2005 (sửa đổi 2009, 2019, 2022)04
- MoSCoW (DSDM / Agile Business Consortium)03
- Nghị định 123/2020/NĐ-CP04
- Nghị định 356/2025/NĐ-CP20
- Nielsen — 10 Usability Heuristics06
- NIST SP 800-218 (SSDF)12
- NIST SP 800-61 Rev. 318
- NIST SP 800-8820
- OMG BPMN 2.0.202
- OpenAPI Specification 3.107
- OpenFeature (CNCF)15
- OWASP ASVS 5.012
- OWASP Top 1012
- PMBOK® — Three-point estimating (PERT)03
- PMBOK® Guide 6th ed. — Close Project or Phase (4.7)17
- PMI — PMBOK® Guide 7th ed.00, 03
- PRINCE2® 7th ed. (2023)01
- Retrospective Prime Directive (Norm Kerth, 2001)17
- RFC 8555 (ACME)13
- Semantic Versioning 2.0.015, 16
- STRIDE (Microsoft)07
- The Scrum Guide (2020)08
- The Twelve-Factor App08
- WCAG 2.2 (W3C, 2023)06
Across every stage
What runs through every stage
Communication & weekly reports
The client never has to guess where the project stands.
- Weekly report: done, next, risks, decisions needed
- End-of-sprint demo on staging
- One main channel (email / chat group) + a shared board the client follows via a share link
Governance & escalation
Who decides what, and whom to call when stuck — written down at kick-off.
- A RACI matrix per stage: every activity has exactly one accountable person
- Three-level escalation: day-to-day contacts → project managers → sponsors on both sides
- Quality gates have named approvers — no implicit approval
Change management
Change is normal; uncontrolled change is the problem.
- Every out-of-scope request goes through a CR form
- Each CR gets an impact assessment: time, cost, risk
- Work starts only after written approval
Quality gates between stages
Every stage has explicit entry and exit criteria — no pass, no next step.
- Documents are approved before anything builds on them
- Green CI is a merge requirement
- Acceptance is against signed criteria, not feelings
Risk management
A risk written down early is cheaper than one discovered late.
- Risk register: likelihood × impact, owner, response
- Reviewed every sprint
- Small teams: the "single person" dependency (illness, absence) is stated up front with a fallback plan
Personal data & information security
Client and end-user data is protected at every stage, not only in the security stage.
- Collect and move only what is needed; test data is anonymised
- Controller / processor roles written into the contract
- Team access is least-privilege and revoked at closure
Responsible use of AI
I use AI assistants to move faster — but I own every line I ship.
- AI-suggested code is read, tested and reviewed like any other code
- No client secrets or personal data sent to public AI services without consent
- Be transparent with the client about where AI is used
Living docs & traceability
Docs travel with the code, not as a pile of paper at the end.
- Requirements ↔ design ↔ tests ↔ commits are linked
- Every stage has downloadable templates; small projects merge documents but never skip steps
AI-native delivery
AI makes it faster. People stay accountable.
The studio uses AI in almost every phase — under explicit rules: spec first, AI writes, someone else approves, everything labelled and traceable.
- 01
Intent capture
- 02
Machine-readable spec
- 03
Agentic synthesis
- 04
Independent check + human sign-off
Five principles
AI writes — someone else approves
Whatever AI synthesises never approves its own release. Another person (or an independent check such as CI or human-written tests) reviews it before merge. The person who approves is accountable for the change — not the tool.
Labelled and traceable
Every AI-assisted change is labelled "AI-assisted" and linked: change ↔ spec version used ↔ tool/model ↔ gate results (review, CI). When something breaks, its origin is known.
Client data stays out of AI without consent
Client internal documents, source code and personal data go into an AI tool only with the client’s written consent, through a provider named in the DPA. Where stricter control is needed, the client’s own AI account or a local model is used.
Security: AI & dataQuotes from calibrated estimates
AI speed varies by kind of work, so there is no blanket "X% faster" factor. On larger projects the studio first builds a small slice end-to-end, measures the real effort, and only then commits to an estimate for the rest.
What AI does, what people approve — by phase
| Phase | AI assists with | People approve & own |
|---|---|---|
| Discover | AI assists withSummarise meeting notes, suggest missing discovery questions. | People approveBA checks against what the client actually said; client documents stay out of AI until the NDA and consent are in place. |
| Define | AI assists withDraft user stories and Given/When/Then; flag vague words, contradictions and missing edge cases. | People approveBA finalises; someone other than the author scores Spec Fidelity; the client signs the SRS. Estimates are committed only after a small calibration slice. |
| Design | AI assists withPropose alternative architectures, draft ADRs, build quick prototypes to test ideas. | People approveArchitecture picks the option and records why; UX validates with real users, not with the AI’s opinion. |
| Build | AI assists withGenerate code from stories with acceptance criteria, write unit tests, refactor. | People approveAnother developer reviews the AI-assisted PR; CI green on the final version; nothing unread is merged. |
| Verify | AI assists withSuggest edge-case tests, generate synthetic test data, read logs to narrow down defects. | People approveQA decides pass / fail; AppSec reviews sensitive parts; when AI repaired a test, AI does not declare the pass. |
| Ship | AI assists withDraft release notes from the change history, and user guides. | People approvePM and client approve the wording; go-live decisions and acceptance records are always signed by people. |
| Run | AI assists withSummarise incident logs, triage tickets, draft postmortems. | People approveThe on-call person decides on recovery; AI agents get no write access to production; root cause is confirmed by a person. |
The same 7 phases as the timeline above.
The Spec Fidelity gate: is the spec good enough to hand to AI?
Each requirement is scored on four dimensions. The spec passes only when it meets the threshold both sides agreed, and the scorer is not the author. Below threshold, the spec is fixed — AI is not left to guess the gaps.
An exit criterion of stage 05 · Requirements specification.
Completeness
Edge cases and failure modes are written down, not just the happy path.
- Weak
- Students book a lab room.
- Strong
- Students book a free room. If the slot is taken, the system refuses and shows message MSG-07. If the connection drops mid-way, no half-made booking is created.
Consistency
Requirements do not contradict each other.
- Weak
- BR-03: Students may cancel at any time. · BR-11: Bookings cannot be cancelled within 24 hours of the slot.
- Strong
- BR-03: Students may cancel up to 24 hours before the slot; after that only the lab manager can cancel (see BR-11).
Unambiguity
Two readers understand it the same way, and still do next week.
- Weak
- The equipment list page must load fast.
- Strong
- The equipment list page (500 items) shows its main content (LCP) in under 2.5 s at the 75th percentile on 4G.
Verifiability
An objective pass / fail check can be written — ideally automated.
- Weak
- The system is user-friendly.
- Strong
- Given a signed-in student, When they book a free room, Then the booking appears in "My bookings" and a confirmation email is sent within 1 minute.
CT Work
Where project work is managed. CT Work checks specification quality on the four Spec Fidelity dimensions before work is handed out, and labels AI-assisted changes so they link back to the requirement, the spec version and the review result.
Open CT WorkAI Code
The coding agent in the studio’s desktop app: reads and edits code on the machine. Every file edit shows a diff for approval before it is written; a plan-only mode changes nothing. On client code the studio uses the ask-before-every-edit-or-command mode.
Get the desktop appTemplates
The AI policy is a reference template; a lawyer should review it before it goes into a contract.
References
- ISO/IEC/IEEE 29148:2018 — Systems and software engineering — Life cycle processes — Requirements engineering. Characteristics of good requirements: unambiguous, complete, consistent, verifiable.
- Vu Hung Nguyen & Thanh Nguyen, “SDAD: Spec-Driven Agentic Development for the AI-Native SDLC”, arXiv:2608.20341 — technical report, not peer-reviewed. This page borrows only its concepts (the four steps, Spec Fidelity, separating synthesis from release authority, provenance, role shifts, calibrated estimation) — none of its estimated figures.
Organisation
14 functions and what they hand each other
A map of hand-offs between functions — who passes what to whom — and the overall RACI matrix by stage. On small projects one person holds several roles, but each role still owns its outputs.