Skip to content

Prompt to Prototype

An open, vendor-neutral adoption framework for AI-assisted software development, from first prompt to production, for companies of any size.

"Vibe coding" is the practice of directing AI tools to generate working software from natural-language intent. It went from curiosity to boardroom topic in under three years. Early studies showed developers finishing sandbox tasks 55.8% faster with AI assistants1. Two years later, DORA's 2024 State of DevOps report found that the same tools correlated with a 1.5% drop in delivery throughput and a 7.2% drop in delivery stability at the team level2. Both findings are true. The difference is governance.

This framework exists to help any company, from a three-person startup to a Fortune 500, capture the productivity benefits without inheriting the quality, security, and compliance debt.

What you get here

  • Adoption roadmap A four-phase rollout (Readiness, Pilot, Scale, Optimize) with concrete exit criteria for each phase.

  • Meeting worksheets Ready-to-use templates for leadership charters, risk workshops, AUP drafts, vendor scorecards, pilot retros, and incident tabletops. Every one ends in a durable Decision Record.

  • Governance RACI, risk classification, data-handling policy, IP & licensing, audit trails, and regulatory crosswalks (SOC 2, ISO 27001, ISO 42001, EU AI Act, HIPAA, PCI DSS).

  • Frameworks The seven named practices (S.C.A.F.F., V.E.R.I.F.Y., S.E.C.U.R.E., S.H.I.E.L.D., C.L.E.A.R., R.E.F.A.C.T., D.O.C.S., C.O.D.E.S.) that instrument the day-to-day work.

  • Measurement Vanity metrics to avoid, and the SPACE / DevEx / DORA metrics that actually tell you whether AI adoption is working.

  • Evidence & examples Publicly sourced studies, named enterprise rollouts, documented security incidents, and cautionary tales, with verifiable URLs on every claim.

Why this framework?

Most published guidance on AI-assisted development falls into one of three buckets: vendor case studies that overstate gains, security advisories that overstate risk, or slide-deck principles with no implementation detail. This framework sits in the gap by:

  1. Being vendor-neutral. No preferred tool. No paid tier. The practices work with GitHub Copilot, Cursor, Claude Code, Windsurf, Cody, Amazon Q, self-hosted models, or any combination.
  2. Citing its sources. Every quantitative claim links to a public URL. Where the claim is vendor-funded, we say so; where evidence is thin, we say so.
  3. Producing artifacts. Every framework component ships a reusable template: a prompt pattern, a review checklist, a decision record, a tabletop script.
  4. Sizing the work. Every recommendation is tagged Small / Mid / Enterprise so small teams aren't drowned in process and large teams aren't under-served.

How to use this site

New here? Start at the roadmap.

Read the roadmap overview, find the phase closest to your current state, and work backwards. Most companies begin at Phase 1 (Pilot) rather than Phase 0, then discover they need to retrofit Phase 0 governance afterwards.

Running a decision meeting this week?

Jump straight to the worksheets index and pick the one that matches the meeting. Each worksheet is a single page and ends with a Decision Record you can paste into your wiki.

Want to cite this framework to leadership?

Every claim on this site links to a public primary source. For the single-page evidence pack, see the Evidence overview.

Status & cadence

  • Current version: 0.1 (Foundation; expect frequent changes).
  • Update cadence: rolling; expect changes month over month.
  • Next planned review: see each page's review_by date in its frontmatter.

The framework is not currently accepting external contributions.

  1. Peng, Kalliamvakou, Cihon, Demirer, "The Impact of AI on Developer Productivity: Evidence from GitHub Copilot", arXiv:2302.06590, Feb 2023. ↩

  2. Google Cloud / DORA, "2024 Accelerate State of DevOps Report", Oct 2024. ↩