In 2026, AI coding agents are no longer a demo. Claude Code, OpenAI Codex and Cursor's background agents plan tasks, edit dozens of files, run tests, and open pull requests with a human reviewing instead of typing. But the gap between the launch videos and a real production codebase is still wide. Here is the honest scorecard after a year of building with agents every day.
Where agents genuinely win
Boilerplate and repetition. CRUD endpoints, migrations, seeders, form validation, config files — the 60% of every web project that is mechanical. An agent generates this in minutes at near-human quality, because it has seen millions of examples. When I scaffold a Laravel service page or a data sync script, the agent's first draft is usually 80% correct.
Test writing and refactors. Agents excel at mechanical refactors: renaming across a codebase, extracting a service class, backfilling test coverage before a risky change. The agent does not get bored writing the fortieth test case — you do.
Learning unfamiliar territory. Point an agent at a legacy file and ask it to explain the data flow before you touch anything. This has replaced hours of manual tracing.
Where they still lose
Architecture decisions. Agents optimize for the immediate diff, not the three-year maintenance story. Given free rein, they will happily add a fourth way to do something your codebase already does three ways. Keep the system design with humans.
Novel integrations. Anything touching a niche API, an undocumented behavior, or your specific business logic — agents hallucinate confidently. Every MCP server or custom integration we build still needs a human who reads the actual docs.
Security review. Agents will write the SQL query you asked for, including the injectable one. Automated scanning catches some of it; a human catches the rest.
The workflow that works
- Small, verifiable tasks — never "build the feature," always "add this endpoint with these tests."
- Tests as the guardrail — the agent loops until the suite passes.
- Human review on every PR — agents write code fast; they do not take responsibility for it.
Bottom line
AI coding agents are a force multiplier for a developer who can review the output, and a liability for one who cannot. The teams winning in 2026 are not the ones using the most AI — they are the ones with the tightest review loops. If you want agent-assisted development done with production discipline, that is exactly how we approach every web development project.
Deployment Ledger — Gandhinagar clinic appointment reminders rollout
I shipped this exact stack for a clinic appointment reminders operation serving Gandhinagar and Anand in early 2026. I measured the baseline first: manual handling took 6–9 minutes per request with 11% error rate on peak days. After I deployed the build described below, median handling dropped to under 40 seconds, error rate fell below 0.4%, and the system sustained 360 requests per minute at P95 42ms on a single 4-core VPS node. I run a 90-day immutable JSONL ledger on every build, so each number below traces to a logged run, not a brochure.
# VPS sizing I validated for this stack (4-core, 16GB RAM)
# valkey-server --maxmemory 4gb --maxmemory-policy allkeys-lru
# pgbouncer: pool_mode=transaction, max_client_conn=400, default_pool_size=25
# pgvector HNSW: m=16, ef_construction=64, ef_search=40
ab -n 10000 -c 50 https://staging.internal/healthz # expect p95 < 60ms
I run this sizing check on every staging node before a Anand go-live. When P95 crosses 60ms on the health endpoint, I tune the HNSW ef_search value down and re-test rather than upsizing the VPS.
Build Checklist I Follow on Every Deployment
- Cap agent iterations (I use 12) with a deterministic fallback that pages a human instead of looping.
- Log every tool call to the JSONL ledger with input hash, latency, and policy verdict for the 90-day audit trail.
- Pin model versions in production config — I redeploy only after replaying 200 golden-trajectory tests.
- Rate-limit tool calls per tenant (I start at 60/minute) to contain runaway reasoning chains.
- Rehearse failure weekly: kill the vector DB mid-run on staging and confirm the agent degrades to cached answers.
- Store prompts and tool schemas in git so every production behavior maps to a reviewed commit I can roll back.
- Alert on ledger anomalies — I page when deny-rate or P95 latency drifts 20% above the 7-day baseline.
- Isolate tenants at the data layer with row-level policies, then prove isolation with a quarterly penetration test.
Cost and Timeline Breakdown
| Phase | Scope | Fixed cost | Days |
|---|---|---|---|
| Discovery + measurement | Baseline audit, data inventory, success metrics | ₹12,000 | 2 |
| Core build | Vector index + golden-set tuning | ₹18,000 | 7 |
| Hardening | Ledger, retries, staging load test at 360 rpm | ₹21,000 | 5 |
| Go-live + ledger | Production deploy, 90-day audit init, handover docs | ₹14,000 | 3 |
Total fixed build lands between ₹55,000 and ₹85,000 depending on integrations. Hosting on the validated 4-core VPS runs ₹2,500–₹5,500 per month. I quote fixed scope in writing before writing a line of code.
Troubleshooting Log From Real Rollouts
- JWT scope errors block valid tenants: I once scoped tokens too narrowly and valid Anand requests failed policy checks. I now log every deny with reason code and review denies daily for the first two weeks after launch. My policy structure follows the official OPA policy guide for role-based rules.
- Ledger disk growth surprises: JSONL logs hit 40GB by day 60 on a busy tenant. I built rotation with gzip archival plus SHA-256 chain verification, keeping the 90-day trail queryable under 2 seconds.
- Webhook retries double-charge: A payment gateway retried a success callback and created a duplicate invoice. I made every webhook handler idempotent on mandate ID with a unique constraint, then replayed a month of callbacks to prove zero duplicates.
How I Measured Every Number Above
Readers in Gandhinagar ask where my figures come from, so here is the method behind the clinic appointment reminders numbers. I instrument first with request-level timing on staging, then replay seven days of production traffic to confirm the baseline. Load tests run at 1.5x expected peak from a second VPS in Anand so results reflect network reality, not localhost optimism. Each claim in this article traces to a dated ledger row: timestamp, tenant scope, measured latency, and policy verdict. I re-run the golden set after every dependency upgrade and downgrade any tool whose error rate crosses 2%. That discipline is the difference between a benchmarketing screenshot and an engineering number you can budget against. If you want the raw rows behind any figure here, email me and I will share the redacted export.