Quality gate for agentic AI

Managing Sonar way for agentic AI quality gate.

Sonar way for agentic AI quality gate

The Sonar way for agentic AI quality gate replaces the Sonar way for AI Code quality gate. If your projects used the Sonar way for AI Code quality gate, they are now marked as legacy.

The Sonar way for agentic AI quality gate is a built-in quality gate optimized for agent centric development lifecycles where AI agents are generating or modifying code. The new standard is optimized to balance protection and development velocity.

Sonar way for agentic AI quality gate conditions

The quality gate enforces six conditions on new code:

1. Software quality: No new Reliability issues with severity greater or equal to Low. Type: No new Bugs with severity greater or equal to Minor.
2. Software quality: No new Security issues with severity greater or equal to Low. Type: No new Vulnerabilities with severity greater or equal to Minor.
3. Software quality: No new Maintainability issues with severity greater or equal to Medium. Type: No new Code Smells with severity greater or equal to Major.
4. No new Dependency Risks with severity greater or equal to Low.
5. Coverage on new code is greater or equal to 80%.
6. Duplication on new code is less or equal to 3%

Dependency Risks are part of Advanced Security and are available as a product that requires a separate subscription. If your plan doesn’t include SonarQube Advanced Security, the Dependency Risk condition will be grayed out and the quality gate will skip it.

We recommend you use the Sonar way for agentic AI quality gate in conjunction with the Sonar agentic AI quality profile if you want to optimize the standards for agent centric development. See Quality profiles for agentic AI for language support.

Importance of the Dependency Risks condition

In agentic development, where AI agents have the autonomy to write code and introduce dependencies, the dependency risk condition is an important aspect of the Sonar way for agentic AI quality gate. When an agent introduces a library to solve a problem, it can unknowingly open the door to a digital intruder. Managing these dependency risks is critical because agents may autonomously install packages without manual vetting, which escalates the risk.

Dependency Risks are part of Advanced Security and are available as a product that requires a separate subscription.

Assign quality gate to your project

To assign the Sonar way for agentic AI quality gate at a project level as a replacement of the default quality gate set at the instance level:

1. Go to Your project > Project Settings > Quality Gate.
2. Select the Use a specific quality gate option.
3. From the drop-down menu, select the Sonar way for agentic AI quality gate.

Assign quality gate at the instance level

You can set the Sonar way for agentic AI quality gate as the default quality gate for all projects on the instance.

1. Select Quality Gates from the top menu.
2. From the available quality gates, select Sonar way for agentic AI.
3. In the details view, select the action menu > Set as default.

Customizing a quality gate

You can copy the Sonar way for agentic AI quality gate and edit its conditions to suit your specific needs. See Managing custom quality gates for more details.

Qualifying custom quality gate for AI Code Assurance

Any quality gate can be marked as qualified for AI code with the AI Code Assurance status label available for quality gates. To activate this label, open the Actions menu of your quality gate on the Quality Gates page and select Qualify for AI Code Assurance. Before you create a custom quality gate for AI code, check the conditions included in the Sonar way for agentic AI quality gate.

Apply custom quality gate for AI Code Assurance

The final step in achieving AI Code Assurance requires that an AI-qualified quality gate be applied to your project. In SonarQube Server, navigate to Your Project > Project Settings > Quality Gate.

1. If you’ve already labeled your project as containing AI code, it’s eligible for the AI Code Assurance status label; all you need to do is apply an AI-qualified quality gate. See the Label projects with AI code article if needed.
2. Select a quality gate qualified for AI Code Assurance.

Projects completing these steps will show their AI Code Assurance status on the Projects, main-branch Overview, and Project Information pages. To understand the status labels and badges for AI Code Assurance, see the Monitor projects with AI code page.

Projects marked as containing AI-generated code and do not use an AI Code Assured quality gate will only display the label.

Monitoring your projects

If you’ve completed the steps to apply AI Code Assured quality gates to your project, a series of external badges are available to publish on your websites. For more details, see the Monitor projects with AI code page.

Related pages

• Managing custom quality gates

• Quality profiles for agentic AI

• Advanced Security

• Monitor projects with AI code