AI-powered SDLC with Claude Code, Claude Design, and Claude Cowork
This is the recommended default implementation on this site. Claude Code is a codebase-native agent that reads a repository, edits files, runs commands, and integrates with developer tools directly in the terminal, IDE, desktop app, or browser (Claude Code overview). Two newer Anthropic products extend the same agentic core past the terminal: Claude Design turns prompts into runnable prototypes with a Claude Code handoff, and Claude Cowork runs multi-step agentic work across files and connected apps for the non-developer parts of a delivery team. Anthropic's own documentation states Cowork "uses the same agentic architecture that powers Claude Code, with no terminal required" (Claude Cowork help center) — one agentic core, three surfaces, covering the whole SDLC team rather than only the people who type in a terminal.
Use this approach when the primary bottleneck is moving from ambiguous intent to trustworthy repository changes with human review preserved, and when the wider delivery team (product, design, compliance, support) needs to participate in that loop without learning a CLI.
Grounding the methodology: AWS Labs' AI-DLC v2 on Claude Code
Rather than invent a bespoke lifecycle, this site grounds its SDLC phase structure in AWS Labs' AI-DLC workflows — a genuinely vendor-agnostic, open-source (MIT-0) implementation of the AI-Driven Development Life Cycle methodology, verified directly against its v2 branch. v2 is a near-total rewrite of v1, not an incremental release, and one of its seven supported harnesses is Claude Code itself.
v1 (main branch) | v2 branch (current) | |
|---|---|---|
| Structure | 3 phases (Inception, Construction, Operations) | 5 phases, 32 stages |
| Progression | LLM-judgment, markdown rule files | Deterministic engine — native TypeScript state machine with versioned state |
| Agents | Single-agent, rule-file driven | 14-agent roster: 11 domain experts, 2 quality-gate reviewers, 1 adaptive-workflows composer |
| Audit | Unstructured | 82-event audit trail for enterprise traceability |
| Knowledge | None | Two-tier knowledge system — team knowledge plus a rules/learning loop that turns human corrections into persistent behavioral rules |
The 32 stages, verified directly against the v2 branch's file tree, break down as:
| Phase | Stages |
|---|---|
| Initialization | state-init, workspace-detection, workspace-scaffold |
| Ideation | intent-capture, feasibility, market-research, scope-definition, team-formation, rough-mockups, approval-handoff |
| Inception | requirements-analysis, user-stories, application-design, refined-mockups, practices-discovery, reverse-engineering, units-generation, delivery-planning |
| Construction | functional-design, nfr-requirements, nfr-design, infrastructure-design, code-generation, build-and-test, ci-pipeline |
| Operation | environment-provisioning, deployment-pipeline, deployment-execution, observability-setup, performance-validation, incident-response, feedback-optimization |
The 14-agent roster maps to real files, not marketing labels: architect, architecture-reviewer, aws-platform, compliance, composer, delivery, design, developer, devsecops, operations, pipeline-deploy, product, product-lead, and quality agents, each a scoped persona definition rather than one undifferentiated assistant.
How it runs on Claude Code specifically: installing the Claude harness (dist/claude/.claude/ and dist/claude/aidlc/) adds a real /aidlc slash-command family to a project — /aidlc to start, /aidlc --doctor to validate setup, /aidlc --stage <slug> or --phase <name> to jump directly to a stage or phase, --depth <level> and --test-strategy <level> to tune how much of each stage runs, --review <adversarial|advisory|none> to cap review intensity, and /aidlc compose "<task>" to generate a tailored plan up front or mid-workflow. Per-stage runners (/aidlc-application-design, /aidlc-code-generation, and one per stage above) let a team run a single stage in isolation without advancing the main workflow's state. Read-only introspection skills (/aidlc-session-cost, /aidlc-replay, /aidlc-outcomes-pack) expose cost and audit history. Under the hood it delegates staged work to Claude Code subagents via the Task tool and uses hooks so the decision log, saved progress, and status display stay correct automatically, rather than relying on the model to remember to update them.
Two things worth knowing before adopting it: the shipped Claude Code configuration runs through Amazon Bedrock (CLAUDE_CODE_USE_BEDROCK=1), not the Anthropic API directly, and AWS's own README states it "works better with Claude Opus 4.8" — treat that as the vendor's current tuning target, not a hard requirement. Teams that want the AI-DLC phase discipline without the Bedrock dependency can use the phase/stage/agent model as a structural reference (the table above) while running the actual agents through direct Anthropic API access instead.
Claude Code: current capabilities
Beyond the basics (headless -p/print mode, --json-schema structured output, --permission-mode, subagents, hooks, skills, slash commands — all used throughout this site's own publishing pipeline), several changes are load-bearing for production and team use as of mid-2026:
- Background subagents by default. Subagents now run in the background rather than blocking the main session;
/forkspins up a new background session and/subtaskis the lighter in-session subagent primitive (changelog). - Self-hosted runners. Team and Enterprise plans can run Claude Code web, mobile, and desktop sessions on their own infrastructure with internal network access via
claude self-hosted-runner— relevant wherever a coding agent needs to reach an internal service, VPN, or on-prem system that a hosted session cannot. - Sandboxing.
sandbox.filesystem.disabledandsandbox.network.strictAllowlistconstrain what a session can touch; credential values (including JWTs and AWS SigV4 signatures) are masked from the model's context automatically, and denied actions now surface why they were denied so the model can adjust rather than silently retry. - Permission modes. The default mode was renamed from "default" to Manual; Auto mode (autonomous agentic execution) is now available without an opt-in flag on Bedrock, Vertex, and Foundry deployments.
- Plugins and marketplace. Plugins bundle skills, subagents, hooks, MCP servers, LSP servers, and monitors into one installable unit. Anthropic runs an official marketplace (
anthropics/claude-plugins-official); community marketplaces list several hundred plugins covering the common enterprise SDLC integrations (issue trackers, CI systems, observability). - Spend controls.
--max-budget-usdhalts background subagents once a session hits its budget cap, and gateway-level spend limits can be applied above that.
Reference architecture
| Layer | Anthropic capability | SDLC role |
|---|---|---|
| Team memory | CLAUDE.md, auto memory, project/user instructions | Keeps conventions, architecture rules, and recurring corrections visible to the agent (memory, Claude directory). |
| Reusable workflows | Claude Code skills, plugins | Packages repeatable procedures, scripts, templates, and domain knowledge for on-demand or background use (skills, skill best practices, plugins). |
| Specialist review | Subagents, background /fork sessions | Separates roles such as architect, security reviewer, tester, and release analyst, running concurrently rather than serially (subagents). |
| Guardrails | Permissions, hooks, sandboxing | Controls what tools can run, adds deterministic checks around agent actions, and constrains filesystem/network access at the process level (permissions, hooks). |
| Enterprise tools | MCP | Connects Claude to issue trackers, documentation, observability, and internal systems through governed tools (MCP). |
| Productized agents | Agent SDK, Managed Agents, self-hosted runners | Runs the same patterns outside the local coding session for platform workflows, managed agent sessions, and internal-network access (Agent SDK, Managed Agents). |
| Design-to-dev handoff | Claude Design | Turns prompts, images, and documents into runnable prototypes and applies an org's design system, then hands the result to Claude Code for implementation (Claude Design). |
| Non-developer agentic work | Claude Cowork | Runs multi-step tasks across local files and connected apps (Slack, Drive, Gmail, Microsoft 365) with the same agentic core as Claude Code, for teammates who never open a terminal (Claude Cowork). |
Implementation map
| SDLC pattern | Implementation with Claude and Anthropic |
|---|---|
| 1. Requirements and specification | Create a requirements-enrichment skill that reads a story, relevant CLAUDE.md guidance, service docs, and issue context through MCP. It should output ambiguities, missing acceptance criteria, compliance risks, and rollback criteria. Where the AI-DLC phase model is in use, this maps to its Ideation and Inception stages (intent-capture, requirements-analysis, user-stories). Product owners who don't use a terminal can run the same enrichment through Claude Cowork, reviewing the output in Slack or Drive rather than a CLI. Keep write actions in ask mode until a human approves the enriched story. |
| 2. Design and architecture | Add architect, security-reviewer, and test-planner subagents (or the AI-DLC roster's architect, architecture-reviewer, and design agents where AI-DLC is in use). Give the architect read access to ADRs, service catalogs, and diagrams through MCP. For visual design artifacts — one-pagers, UI prototypes, stakeholder decks — use Claude Design to go from prompt to a real, runnable prototype with the org's design system applied, then hand it to Claude Code for implementation rather than re-building it from a static mockup. The human lead approves the ADR. |
| 3. Coding and review | Use Claude Code for implementation, refactoring, and local explanation. Use skills and plugins for repeatable tasks such as migration generation, API contract updates, or framework-specific test creation. Add hooks that run formatters, linters, type checks, secret scans, and architecture checks before code is accepted. Run noisy or long-running review passes as background subagents so they don't block the main session. |
| 4. Testing and quality | Package test-generation guidance as a skill with local scripts. A test subagent proposes risk-based unit, integration, contract, and failure-mode tests, while hooks run the actual test commands. Generated tests should be reviewed for behavioral value rather than coverage optics. |
| 5. Deployment and operations | Use Claude Code for release-note drafting, runbook updates, canary-readiness checks, and rollback-plan review. For workloads that need to reach internal infrastructure, use a self-hosted runner. For higher-scale automation, run workflows through the Agent SDK or Managed Agents with explicit permission policies so production-affecting actions require approval. |
| 6. Monitoring and feedback loops | Use MCP connectors to summarize incidents, logs, tickets, and postmortems into candidate memory entries. On-call and support staff can triage and summarize incidents through Claude Cowork without touching the repository. Promote only reviewed lessons into CLAUDE.md, skills, ADRs, or runbooks, so stale observations do not become hidden operating rules. |
Practical build sequence
- Add a project
CLAUDE.mdwith architecture rules, test commands, security boundaries, and "definition of done" checks. - Create three initial skills:
requirements-enrichment,architecture-impact, andtest-generation. - Add subagents for architecture, security, test planning, and release readiness — or adopt AI-DLC v2's Claude harness wholesale for its 14-agent roster and
/aidlcphase discipline if the team wants a structured, auditable lifecycle out of the box. - Configure permissions so read-only analysis is low friction, file writes are normal developer actions, and shell/network/deploy actions require approval; enable sandboxing (
sandbox.filesystem.disabled,sandbox.network.strictAllowlist) for any session with untrusted input in scope. - Add hooks for deterministic controls: format, lint, type check, dependency audit, secret scan, and protected-file checks.
- Connect MCP servers only where they have clear SDLC value: issues, docs, repo metadata, observability, and change-management systems.
- Extend the loop past developers: give product, design, and support access to the same enriched context through Claude Cowork, and route design artifacts through Claude Design so implementation starts from a real prototype instead of a static mock.
- Capture accepted and rejected Claude suggestions in the PR or change record.
Governance controls
| Risk | Control |
|---|---|
| Agent changes code without enough context | Require the relevant skill to identify source files, tests, ADRs, and owners before editing. |
| Prompted bypass of team rules | Put non-negotiable rules in CLAUDE.md, permissions, and hooks rather than only in chat instructions. |
| Subagents diverge from policy | Give subagents scoped prompts and tool permissions; review high-risk subagent output in the main session. |
| Background work runs unchecked | Use --max-budget-usd to cap background subagent spend, and review /aidlc-outcomes-pack-style session summaries before merging. |
| Untrusted input reaches the filesystem or network | Enable sandboxing; treat any content from outside the repo (web pages, issue text, third-party files) as data, not instructions. |
| Production action without accountability | Use permission policies and approval gates for deployments, data changes, security controls, and incident automation. |
| Stale memory | Treat memory as governed documentation: owner, provenance, expiry, and supersession path. |
| Non-developer agent (Cowork) takes an unreviewed action | Cowork inherits Claude Code's permission and approval model — keep write/send actions gated the same way a coding session would be. |
When this works best
Claude Code fits teams that want rich local agent collaboration, strong project memory, and specialist subagents embedded into day-to-day engineering. Layering AI-DLC v2 on top gives that same core a structured, auditable, 32-stage lifecycle with a real 14-agent roster instead of a single undifferentiated assistant — useful for teams that want the discipline of a defined methodology without abandoning Claude Code as the harness. Claude Design and Claude Cowork extend the same agentic core to the parts of the SDLC that never touch a repository: design handoff and cross-functional operational work. Anthropic labels both "Labs"/preview products as of mid-2026, so treat them as evolving rather than settled, and validate current rollout status against their product pages before committing a team workflow to them.
Use the broader Anthropic ecosystem when the pattern must leave the developer workstation: Managed Agents for centralized sessions, Agent SDK for productized workflows, self-hosted runners for internal-network access, and MCP for controlled access to enterprise systems.
Validated citations
- Claude Code overview
- Claude Code changelog
- Claude Code skills
- Claude skill best practices
- Claude Code plugins reference
- Anthropic official plugins marketplace
- Claude Code subagents
- Claude Code memory
- Claude directory
- Claude Code permissions
- Claude Code hooks
- Claude Code MCP
- Claude Code Agent SDK
- Anthropic Managed Agents
- Claude Design announcement
- Claude Cowork product page
- Claude Cowork help center
- AWS Labs AI-DLC workflows (v2 branch)