Javier Núñez

Entry 3 · October 6, 2026 · Field notes · GATE 2/3

How GATE was built

GATE started as a list of problems that kept repeating when working with AI, and building it taught me more than I expected.

  1. A list The problems that kept repeating when working with AI.
  2. The first version Thirteen stages, with checkpoints where a person decides.
  3. A real company Someone had to build the SDLC, and I did.
  4. A company that does not exist An agent invented it and built its SDLC with the guide alone.
  5. What it found 33 problems in GATE. Each one is fixed in the framework.
How GATE was built, from the first list to the test with an invented company.

Second chapter of the series. The first was about what I believe, and this one is about what happened when I put it into practice, which was a lot messier.

GATE started from a list of problems. Once the teams I have led began using AI every day, I kept seeing the same things: decisions got lost, every review depended on who did it and security issues showed up late. And when someone asked which standard had been applied to a change, nobody could answer.

01 Years leading teams The same problems repeat when each person uses AI in their own way 02 GATE's first version A cycle with stages, contracts, control points and a catalog that learns 03 Put into practice Implemented in a real organisation, with its own SDLC 04 Lessons go back into GATE The orchestrator, a formulation phase with a written exit, session permissions and working with any assistant 05 Tested on a simulated company An agent builds an invented company's SDLC from scratch and uses it across the cycle 06 Fixed and published Every gap found is fixed, and the test runs again
How GATE was built

The first version

The first version organised the work into thirteen stages, from the moment someone raises a need until the system runs in production and the team learns from what happened. Each stage says what it receives, what it delivers and who approves it. Between stages there are checkpoints, where the process stops until a person decides.

From the start I made two decisions that still hold. The first was to separate roles: nobody reviews their own change or approves the design they proposed, and whoever builds does not validate the business result.

The second was to start with an empty rule catalog. When a team copies rules from a guide, they feel like someone else's and nobody uses them. The rules had to come from real work, even if that meant starting with almost nothing.

The test in a real company

The real test was applying it in a company with real products, people and deadlines. That is where problems appeared that did not show on paper.

The most important one, and the hardest for me to accept, was that GATE described an SDLC already running but did not say who built it. A role was missing, which I called the orchestrator, and that role was me. While the SDLC is being built, one person proposes and approves everything, and that contradicts the separation of roles GATE itself defends. I solved it by adding a formulation phase with an end condition written down from day one.

I also learned that asking for approval on every write does not work at the real pace of work. It is better to authorise a scope per session and keep a short list of actions that always ask for permission. And important rules cannot live only in the assistant's instructions, because in long sessions the assistant stops following them. They have to be enforced with automatic checks and by the platform itself.

Product people, who often do not use repositories, needed another way to work with the SDLC. And the use cases that product validates turned out to be the best link between defining a requirement and the automated tests that later protect it.

I brought all of that back into GATE. That is also where the idea that shapes it today came from: GATE is a foundation on which each company builds its own SDLC, with the AI assistant it prefers.

A test with a made-up company

I still had one doubt. If GATE only worked with me next to it, I had built one more thing that depended on me. Could another company build its SDLC with only what was published? To test it, an AI agent with no prior context invented a health software company, with its team, its products and simulated tools, and built its SDLC following only the guide.

The agent built a complete SDLC and then used it across the whole cycle. When defining a requirement, it separated the solution the request came with from the real problem. In the self-review it found personal data written to a log. The automated tests caught a regression and, during an incident, filtering by environment avoided a wrong conclusion.

The test also found problems in GATE, which is what I was looking for: gaps in the permission checks, a validator that let rules through without an origin and assumptions about the platform that a small team does not always meet. I am fixing them one by one, and then I will run the test again.

GATE learns too

GATE learns at three levels. The team learns with every review and every incident. The product learns when what was delivered is compared with the original problem. And the framework learns from every company that implements it: each one records where it departs from GATE, and whatever turns out to be a lesson comes back as a proposal, without the company's data.

The team Every review and every incident leaves a rule with its origin, applied before the next change. The product What shipped is measured against the original problem. A failed hypothesis goes back to definition. The framework Each company records where it departs from GATE. What turns out to be a lesson goes back to GATE as a proposal, with no company data.
The three learning loops: the team, the product and the framework

That is why I do not consider it finished. I built it between urgent tasks, like almost everything in a company, and now I want it to belong to the people who use it. The last chapter is a guide for anyone who wants to try, written by someone who has not finished implementing it yet.