Taming the AI Wild West: How APG Built its AI Agent Framework

The era of manual, line-by-line coding is rapidly shifting. Today, software development is increasingly becoming an exercise in prompting AI agents. But as engineering teams hand over more responsibility to these intelligent tools, a critical question emerges: How do we trust AI to implement complex systems correctly, safely, and securely?

At APG, Software Engineer Andres Lizano recognized early on that while AI tools dramatically increase developer speed, they also introduce significant technical debt if left ungoverned.

“AI tools multiply our engineering throughput and productivity, but without shared context, they also multiply inconsistency and risk,” explains Lizano. “When you give an AI agent a prompt, it will try to figure things out on its own rather than telling you it doesn’t know. Without a standardized framework, every developer prompts differently, leading to architecture drift and hidden security gaps.”

To solve this, Lizano designed and deployed a centralized AI Agent Framework - a structured rulebook that establishes a shared context across all APG projects.

The Four AI Failure Modes

Without a enforced framework, AI-assisted development naturally falls into four distinct failure modes:

• The Prompt Lottery: Without shared guidelines, output quality relies entirely on how well an individual developer prompts, rather than adhering to baseline company standards.
• Architecture Drift: Left to their own devices, models will generate quick, messy code (like bloated controllers or inline SQL queries) rather than following modular design patterns.
• Security Gaps: Models often insert placeholders or skip security checks under the assumption that they are only building an MVP, leaving high-risk vulnerabilities open in production.
• Code Bloat & Review Fatigue: AI generates vast amounts of code quickly, forcing human reviewers to waste hours fixing structural bad habits buried in the pull request.

The Four-Layer Solution: The Prompt Contract

Lizano’s solution introduces a “prompt contract” built directly into the repository structure. By maintaining an .agent/ directory in the project, the AI is forced to load specific rules before writing a single line of code:

1. Personas (The “Who”): AI agents are assigned granular roles (e.g., Backend Engineer, UI Specialist, Security Auditor). This keeps the AI focused on relevant instructions and saves valuable context memory.
2. Skills (The “What”): Modular playbooks that instruct the agent on how to execute specific engineering tasks.
3. Standards (The Always-On Rules): Non-negotiable guidelines for security, database migrations, Git workflows, and technical stack choices.
4. Templates (The Bootstrappers): IDE configuration templates that initialize the AI entry point.

Multi-Agent Pipeline: Why AI Shouldn’t Review Its Own Code

A core breakthrough in Lizano’s framework is Multi-Agent Orchestration. A common mistake engineering teams make is asking the same AI chat window to write code and then verify if it is correct.

“When you ask the same agent to do its own code review, it will almost always assume the code is good because it created it. The breakthrough is using a main orchestrator agent to spawn a sub-agent to write the code, and then bringing in a completely separate, context-cleared agent to run an independent audit,” says Lizano.

[Main Orchestrator Agent] ──> Spawns Developer Agent (Executes Code)
                                         │
                                         ▼
[Centralized Changelog] <── Spawns Independent QA/Security Agent (Audits Output)

In Lizano’s model, once the developer agent finishes writing a feature, an independent reviewer agent runs a security and quality check. If issues are caught, the reviewer sends feedback back to the developer agent to fix before a human engineer ever reviews the pull request. Afterward, the agent logs all changes into a centralized Changelog file under an unreleased block, keeping an accurate historical audit trail.

Building for Scale and Consistency

APG’s framework isn’t designed to restrict developer creativity or impose rigid workflows; it’s built to guarantee quality. By combining global company standards with project-specific overrides, APG ensures that whether a project is a fast greenfield MVP or a legacy enterprise application, it meets the exact same baseline of excellence.

By moving from chaotic individual prompting to an orchestrated multi-agent framework, Lizano has helped APG turn generative AI outputs into a predictable, secure, and highly scalable software engineering pipeline.