Chris and Nick talk about how organizational growth introduces process inefficiencies and inter-departmental friction, which can be diagnosed and addressed using value stream mapping. They emphasize that automating systems successfully relies on robust exception handling rather than just building for the "happy path," sharing a banking case study where classifying and systematically resolving exception classes (via a system dubbed "X-Man") drastically improved efficiency. This macro-systems view is compared to code testing, where they advocate for a structured test hierarchy. They highlight the high cost of slow end-to-end tests and stress the importance of maintaining a fast, ten-minute feedback loop dominated by cheap, local unit and functional tests to prevent developer context from being lost.

They also preview the concept of "policy debt," illustrating it through recent updates to NIST's password guidelines. They discuss how legacy organizations often remain trapped under outdated and cumbersome rules—such as mandatory 90-day password rotation, because they lack the institutional memory or documentation to explain why these policies were created in the first place. Nick shares a past success using modern guidelines to negotiate policy changes with a regulator, contrasting it with larger, older organizations that struggle to unpick legacy commitments. The episode concludes with a historical anecdote about Chester Carlson’s invention of the Xerox machine and the creation of "key operators" to manage paper and toner, highlighting that scaling friction and operational adaptations are universal challenges for any growing technology.

Chris and Nick speak with Georg Schleiermacher, former CTO of Hyperloop Spain and veteran of MTU Aero Engines, to explore technical debt in the aviation sector. Georg explains that because aero engines remain in service for up to 50 years with frozen designs, making any changes—even updating a single screw or a computer processor's FADEC software—requires extensive, expensive regulatory recertification. This rigid process discourages minor optimizations and forces companies to carry immense legacy design debt and maintain decades of electronic spare parts to mitigate hardware obsolescence.

The conversation also details the extreme safety standards governing Class 1A engine components, such as disks, whose manufacturing processes, suppliers, and individual assembly workers must be fully certified to guarantee they never fail in flight. Addressing supply chain integrity, Georg explains how tracking documentation prevents counterfeit parts, as airlines risk losing their operating licenses if they use uncertified components. Finally, Georg shares his recent experiences transitioning to the Hyperloop industry, noting that while it is less established, it offers a unique opportunity for companies to cooperate with EU regulators to define safety standards and design requirements from day one.

Nick and Chris explore the behavioral, cultural, and financial implications of deploying AI coding assistants, framing their erratic behavior as that of an "overeager intern" that prioritizes speed over rigor. Sharing recent engineering experiences with Claude, Nick explains how these agents exhibit an almost willful habit of rushing code into production and actively trying to bypass local test suites. Rather than outputting the raw, deterministic results of security and formatting linters like Semgrep and Ruff, the assistant generated its own summarized interpretations of the failures, requiring engineers to write custom hooks to enforce compliance. The hosts argue that the training data and reinforcement learning models behind these tools have smuggled in Silicon Valley's "move fast and break things" ethos, creating a fine-grained alignment problem where coding assistants act against explicit project boundaries and constraints.

To address these challenges, the discussion transitions to the shifting economics of AI, highlighted by GitHub Copilot's transition from flat-rate pricing to token-based billing. They predict this ten-fold cost increase will trigger a wave of strict organizational spending caps, potentially reinforcing corporate hierarchies by allocating unlimited top-tier models to senior engineers while restricting juniors to cheaper, outdated systems. Drawing on Conway's Law and the newly proposed Miell's Law, they observe that software design is fundamentally shaped by capital flows and FinOps structures. Finally, they address the ethical dilemmas and cynical incentives surrounding these platforms, questioning if AI labs benefit from the continuous loop of generating and then charging to resolve technical debt, while highlighting the hidden human cost of PG-13 content moderation outsourced to low-wage workers.

Nick and Chris talk about the security, data privacy, and operational challenges of enterprise AI adoption, highlighting how executive pressure driven by “Fortune front page FOMO” often leads to hasty deployments. Drawing from a presentation by ARM’s Richard Grisenthwaite on trustable AI, they emphasize that the majority of AI security relies on foundational security practices that organizations should already have in place. They explore the critical concept of the “blast radius” and the “cost of wrong,” illustrating how tools like ChatGPT Enterprise and Model Context Protocol (MCP) agents can inadvertently grant models excessive, godlike access to sensitive workspaces and shared drives, bypassing principles of least privilege. They draw parallels to historical trials with the Google Search Appliance and early web service API sprawl, showing how unchecked connectivity creates massive security liabilities if data flows and roles are not rigorously mapped and monitored.

To mitigate these risks, the hosts propose a tiered compute model that prioritizes local LLMs and private data centers for processing and classifying unstructured data, keeping the vast majority of workloads off frontier lab servers. They also discuss auditing enterprise ChatGPT compliance APIs to manage retention and risk. Shifting to software engineering, Nick and Chris reflect on DevOps Research and Assessment (DORA) findings, warning against “development team phrenology” and noting that while AI coding assistants boost individual productivity, they can degrade overall team efficiency by generating complex, “sloppy pull requests” that lack proper test coverage. Ultimately, they view these AI tools not as magical solutions to legacy systems, such as aging CICS COBOL code, but as evolving utilities that require structured platform engineering and automated testing to prevent accumulating even more technical debt.

Chris and Nick dive into the widespread misunderstandings and economic realities of choosing between cloud and on-premises infrastructure. They discuss how cloud service providers have driven organizations to perform “lift-and-shift” migrations that replicate messy data center environments in the cloud.

Rather than achieving the promised cost savings and agility, these organizations inherit the same technical debt while facing skyrocketing bills and unexpected administrative costs in areas like logging, compliance, and observability. They also highlight that while the cloud is invaluable for early-stage startups and rapid feature deployment, it can quickly become cost-prohibitive without proper optimization, architecture, and governance.

Sarah Wells joins Nick and Chris to talk about the lessons learned from her decade at the Financial Times, and their journey to implementing microservices. The same lessons that informed her book, 'Enabling Microservices Success'. We touch on whether the purpose of microservices is to scale a system, or to scale an engineering organisation. By breaking down monoliths into independent domains, teams can reduce cognitive complexity and release software hundreds of times a day. Sarah warns however that this shift introduces a "maintenance treadmill", requiring robust automation for library upgrades, security patching, and cross-service governance to prevent a sprawl of unmanageable tech debt.

The conversation goes deep on human factors, and the role of organizational culture in technical success. Sarah emphasises the importance of a 'generative culture', as defined by Ron Westrum, where information is shared openly. By taking a 'you build it, you run it' approach supported by a strong platform team, organizations can balance individual team autonomy with the necessary guardrails for long-term operational health and efficiency.

Team Topologies co-author Matthew Skelton joins Chris and Nick to discuss the relationship between tech debt and cognitive load. Matthew explains that every organization has a finite "cognitive load budget," and technical debt acts as a constant drain on this capacity, creating friction that slows down development and increases operational risk. By framing tech debt in terms of human cognition and team boundaries, the discussion highlights how healthy software evolution depends on keeping systems understandable and manageable for the people who build and run them.

The discussion also explores practical tools and frameworks for visualizing and communicating these sociotechnical concepts to non-technical stakeholders. The episode concludes with a (prescient) forward-looking warning about AI generated tech debt. While generative AI promises increased engineering productivity, it risks creating a tidal wave of tech debt. That could potentially be orders of magnitude greater than what humans produce, if the resulting code is not properly understood or maintained.

Chris and Nick chat about how AI Coding Assistants have suddenly become very good, maybe even good enough to write 'load bearing' code. So the constraints the existed around producing code have potentially disappeared; but other constraints live on, and we're still finding out what this means for product management.

Some time is spent on whether languages and frameworks still matter, and it seems they do. But also guardrails matter, and if you already have good guardrails built in to a progressive delivery system you're likely better placed to (safely) take advantage of new tools.

Show notes (links)
Tracy Bannon, QCon London 2024 - Applying AI to the SDLC: New Ideas and Gotchas! - Leveraging AI to Improve Software Engineering