The AI-Ready Infrastructure Playbook

Why faster coding hasn't meant faster delivery

Two out of three software firms have rolled out generative AI tools. The typical result is a 10 to 15% productivity boost, and Bain's assessment is blunt: the time saved often isn't redirected toward higher-value work. Companies that pair AI with end-to-end process transformation report 25 to 30%.¹

The gap between those two numbers comes from everything around the tooling. Writing and testing code accounts for only 25 to 35% of the time from idea to launch, so compressing that one stage does not speed up the pipeline; it moves the queue downstream.

Where the queue forms

Telemetry from 8.1 million pull requests across 4,800 organizations shows what happens after the code is written: AI-generated pull requests wait 4.6x longer for their first review than human-written ones, and their acceptance rate is 32.7%, versus 84.4% for manual PRs.² The time saved in writing the code is absorbed by the stages that follow it.

Figure 01 — where work accumulatesDesign → Operate

The stages after code generation still run at their previous speed, so work accumulates before deployment. Illustrative, not to scale.

Developers feel both sides of this at once. In Atlassian's 2025 survey, 68% of developers report saving 10 or more hours per week with AI. Half of them lose 10 or more hours per week to organizational friction: waiting on environments, hunting for information, and context switching.³

Infrastructure is falling behind

After the review queue, the next place AI-generated code runs into trouble is infrastructure. In a 2026 survey of 406 IT and platform engineering leaders, 67% report that development is moving ahead of infrastructure in AI adoption, and the consequences are already measurable: 93% of organizations have experienced at least one AI-caused infrastructure incident.⁵

The same survey shows how the gap is being papered over: 78% of teams use AI to generate infrastructure code without thorough review, and only 19% have governance foundations for AI in place. Teams are pushing AI-speed changes through infrastructure built for human-speed change control.⁵

The layer underneath was already strained

Infrastructure teams were behind before AI arrived. 35% of teams tie configuration drift to multiple costly production incidents in the past year. 90% agree their infrastructure orchestration falls short of what they need, and only 8% report managing infrastructure as code at scale without notable issues.⁶ AI did not create this gap, but it has made the gap expensive.

DORA's research puts the two-year arc plainly. In 2024, every 25% increase in AI adoption was accompanied by an estimated 1.5% decrease in delivery throughput and a 7.2% decrease in delivery stability. By 2025, throughput had recovered, but the instability finding persisted, and the report's central conclusion changed shape: AI acts as an amplifier of the system around it. Organizations with strong platforms convert AI speed into delivery performance. Organizations without them convert it into incidents.⁷

What AI can and can't do in infrastructure

The obvious objection is that this gap is temporary: models keep improving, so today's coding agents will operate infrastructure tomorrow. Scores are rising, but they trail application code by a wide margin, and the bar differs in kind: a coding agent's mistakes are caught by tests and review before they run, while an infrastructure agent's mistakes run in production, immediately.

The gap holds within a single model: GPT-4 passes 86.6% of tasks on EvalPlus, the standard Python benchmark, and 19.4% on IaC-Eval, its Terraform equivalent.⁹ Nor is the gap a quirk of HCL syntax: on SWE-InfraBench, Amazon's benchmark of realistic changes to AWS CDK projects, where infrastructure is expressed in TypeScript and Python, the best model succeeds on 34% of single attempts.¹⁰

Two ways to respond

The first is to keep humans in the loop for every infrastructure change and accept that infrastructure remains the rate limiter on everything AI produces upstream. That option also degrades as AI adoption succeeds: human-written infrastructure fails at some rate too, and the production loop absorbs those failures today only because human throughput caps their volume. Multiply change throughput by ten and the same per-change quality delivers ten times the failures to production, so matching human quality is the wrong bar once volume is the goal.

The second is to change what AI has to touch. If infrastructure requirements are expressed inside the application code, as typed, declarative statements of what the service needs, then AI tools operate entirely in the domain where they measurably perform: application code. The platform derives provisioning, environments and configuration from those declarations, so there is no Terraform layer left for anyone, human or agent, to write.

The state of infrastructure as code

Infrastructure as code was the last generation's answer to infrastructure at scale, and it earned its place: versioned, reviewable, repeatable. Two things have changed since: the operational load has outgrown the model, and the ecosystem around its dominant tool has destabilized.

Adoption is nearly universal, at 89% of organizations, but only 6% report complete IaC coverage of their cloud. Industry estimates put up to 40% of cloud resources outside IaC management entirely, with roughly a third of codified resources drifted from their definitions. 48% of teams make out-of-band production changes multiple times per week, which means the code and the cloud disagree by design.⁶

The step beyond IaC is infrastructure derived from the application code itself. The earliest tools in this category leaned on opaque inference, where an SDK guessed what to provision and operators lost visibility into what existed and why. The designs that have taken hold since pair inference with explicitness: infrastructure requirements are declared in the application code as typed resources, the platform provisions them, and operators keep full visibility into the result. In the IaC model, someone, human or agent, writes and maintains a second codebase that the benchmarks in section 03 show AI handles poorly. The declaration model removes that codebase entirely, which is what lets this layer keep pace with AI-generated change.

What defines AI-ready infrastructure

DORA's 2025 research identifies internal platform quality as the factor that determines whether AI adoption translates into organizational performance.⁷ The question for engineering leaders is what, concretely, such a platform must do when a large share of code is machine-generated. Four capabilities determine whether infrastructure keeps pace with that volume.

Review queues shrink when the platform, not the reviewer, guarantees that a change cannot reach production with an unprovisioned dependency or an untraced endpoint. That is what converts AI-generated volume from a liability back into throughput.

Security and governance in the agent era

AI tools read the repository. In a conventional backend setup, the repository contains .env files, Terraform state with cloud account details, and connection strings for production databases. Measured telemetry shows what follows: commits assisted by a leading AI coding agent showed a 3.2% secret-leak rate, more than double the 1.5% baseline across all public GitHub commits, and 2025 saw the largest single-year jump in exposed secrets on record.¹¹

Governance has not kept up with usage. 34% of organizations report that more than 60% of their code is now AI-generated, while only 18% have policies governing the use of AI coding assistants.¹² ISACA puts formal, comprehensive AI policy coverage at 28% of organizations worldwide; the Cloud Security Alliance puts comprehensive AI security governance at 26%.¹³ Adoption is running roughly three times ahead of policy.

Shrink the attack surface

The structural alternative is to reduce what AI tools can see. When credentials, infrastructure state and access policies live in the platform rather than the repository, AI tools see business logic and typed resource declarations, nothing else. The EU AI Act becomes fully applicable in August 2026, and auditors have issued no guidance on AI-generated code under SOC 2 or ISO 27001, so "the AI never had access to production credentials" is the strongest control argument available.¹⁴

Assessing your readiness

Score each area out of four, one point per capability you have in place. Few organizations score full marks, and where the low scores cluster matters more than the total.

Getting started

Closing the infrastructure gap does not require a migration program. The pattern that works starts where the risk is lowest and the contrast is most visible.

Track lead time, deployment frequency, change failure rate and review-queue time for the pilot against your baseline. These are the same metrics DORA ties to AI value realization, and they make the case in the language your board already uses.

About Encore

Encore is a development platform for the AI era, built for a world where AI multiplies software delivery 10–100x rather than making each developer slightly faster. Developers and AI agents declare the infrastructure they need — databases, queues, buckets, cron jobs — directly in ordinary TypeScript or Go, and Encore provisions it in your own AWS or GCP account.

The same application model runs locally, in preview environments, and in production, so changes are validated against real infrastructure before they reach the production loop. There is no separate Terraform layer for anyone, human or agent, to write and keep in sync.

01import { api, SQLDatabase, Topic, Bucket } from "encore.dev";
02 
03// declare what you need, Encore provisions it
04const db = new SQLDatabase("orders");
05const events = new Topic<OrderEvent>("orders");
06const receipts = new Bucket("receipts");
07 
08export const create = api({ method: "POST" }, async (o) => { ... });

$ git push encore
✔ Building application graph
✔ Provisioning Postgres (RDS) · Pub/Sub (SNS+SQS) · Object Storage (S3)
✔ Deploying 6 services to your AWS account (ECS Fargate)
✔ Wiring distributed tracing + metrics
 
→ Live at https://staging-orders-r2qa.encr.app· 42s
→ Dashboard at https://app.encore.dev/orders

Why this matters for this guide

• The infrastructure gap (section 02): agents never touch IaC, because there is none — infrastructure derives from the application code they already write well.
• What AI can and can't do (section 03): the work moves out of the layer where the best models score 56% and into the one where they score up to 97%.
• What defines AI-ready infrastructure (section 05): provisioning, identical environments, guardrails and observability are the default, not a program to stand up.
• Security and governance (section 06): credentials and infrastructure state live in the platform, outside the repository and outside AI reach.