Testing & Quality Control (TQC) Principles

Enterprise Architecture principles for quality assurance in AI-assisted development.

Category Overview

flowchart TB
    subgraph QA["Quality Assurance Lifecycle"]
        direction LR
        Define["Define<br/>Tests first"] --> Generate["Generate<br/>AI Code"]
        Generate --> Test["Test<br/>Execute tests"]
        Test --> Review["Review<br/>Quality review"]
        Review --> Validate["Validate<br/>Security validate"]
    end

    subgraph Principles["TQC Principles"]
        TQC001["TQC-001: AI-Aware Testing"]
        TQC002["TQC-002: Security Practices"]
        TQC003["TQC-003: Quality Framework"]
        TQC004["TQC-004: Continuous Validation"]
    end

    QA --> Principles

Key Concerns:

• Test-driven development with AI implementation
• Security validation of AI-generated code
• Quality metrics and standards enforcement
• Continuous validation throughout development

Principles in This Category

Relationship to Other Categories

flowchart TB
    DC["DC: Development & Coding<br/><i>Generated code to be tested</i>"]
    PS["PS: Planning & Strategy<br/><i>Quality reqs feed back to planning</i>"]
    TQC["TQC: Testing &<br/>Quality Control<br/><i>Quality gates for AI-assisted dev</i>"]
    DM["DM: Deployment & Maintenance<br/><i>Quality gates in pipeline</i>"]
    GSC["GSC: Governance & Security<br/><i>Compliance and audit requirements</i>"]

    DC --> TQC
    PS <--> TQC
    TQC --> DM
    TQC --> GSC

TQC-001: AI-Aware Testing

Statement

Write tests before AI code generation and verify that tests pass against generated code without AI modification of the tests.

Rationale

Implications

flowchart TB
    subgraph Step1["Step 1: Write Test Specification (Human)"]
        S1A["Define expected behaviors"]
        S1B["Write test cases (happy path, errors, edge cases)"]
        S1C["Establish boundaries and assumptions"]
    end

    subgraph Step2["Step 2: Share Context with AI"]
        S2A["Tests that must pass"]
        S2B["Project patterns and conventions"]
        S2C["Constraints and requirements"]
    end

    subgraph Step3["Step 3: Generate Implementation (AI)"]
        S3A["AI generates code to satisfy the tests"]
    end

    subgraph Step4["Step 4: Validate Output (Human)"]
        S4A["✓ All tests pass (RUN them!)"]
        S4B["✓ Tests actually test the code"]
        S4C["✓ No test modifications by AI"]
        S4D["✓ Code follows project patterns"]
        S4E["✓ Security review complete"]
    end

    Step1 --> Step2 --> Step3 --> Step4

Maturity Alignment

Governance

Compliance Measures

• Tests exist before AI code generation
• Test runs documented with results
• AI-modified tests flagged for review
• Test coverage meets thresholds
• Edge cases explicitly tested

Exception Process

Related Principles

• DC-001: AI-Human Collaboration (tests define collaboration)
• DC-003: Code Review Practices (tests inform review)
• DM-001: Pipeline Integration (tests as quality gates)

TQC-002: Security Practices

Statement

Apply security engineering practices to all AI-generated code, treating AI as an untrusted contributor requiring the same security validation as external code.

Rationale

Implications

Five Security Pillars

Security Validation Checklist

Maturity Alignment

Governance

Compliance Measures

• Security requirements in prompts
• Security review completed before merge
• No hardcoded credentials
• Dependency vulnerabilities addressed
• Security scans passing

Exception Process

Related Principles

• DC-003: Code Review Practices — security in review
• DM-001: Pipeline Integration — security gates
• GSC-002: Permission Boundaries — security compliance

TQC-003: Quality Framework

Statement

Apply identical quality standards to AI-generated code as human-written code, with human accountability for all quality outcomes.

Rationale

Implications

Quality Principles

Quality Dimensions

Quality Gates Flow

flowchart LR
    Lint["Lint<br/>Pass"] --> Test["Test<br/>Pass"]
    Test --> Coverage["Coverage<br/>>80%"]
    Coverage --> Review["Review<br/>Approved"]
    Review --> Security["Security<br/>Pass"]
    Security --> Deploy["Deploy"]

Maturity Alignment

Governance

Compliance Measures

• Quality standards documented
• All code passes lint/style checks
• Test coverage meets thresholds
• Code review completed and approved
• Quality metrics tracked and reported

Exception Process

Related Principles

• DC-003: Code Review Practices (review enforces quality)
• DM-001: Pipeline Integration (quality gates in pipeline)
• GSC-001: Governance Framework (quality governance)

TQC-004: Continuous Validation

Statement

Validate AI-assisted deliverables continuously throughout the development lifecycle, not just at completion.

Rationale

Implications

Validation Checkpoints Flow

flowchart LR
    PreGen["Pre-Gen<br/><i>Requirements validation</i>"] --> DuringGen["During Gen<br/><i>Incremental validation</i>"]
    DuringGen --> PostGen["Post-Gen<br/><i>Full test execution</i>"]
    PostGen --> PreMerge["Pre-Merge<br/><i>Gate checks</i>"]
    PreMerge --> PostDeploy["Post-Deploy<br/><i>Monitor production</i>"]

Validation Activities by Phase

Maturity Alignment

Governance

Compliance Measures

• Validation checkpoints defined per phase
• Checkpoint completion documented
• Issues tracked and resolved before progression
• Validation metrics tracked
• Continuous improvement from validation learnings

Exception Process

Related Principles

• DM-001: Pipeline Integration (validation gates)
• DM-002: Observability First (post-deploy validation)
• DC-001: AI-Human Collaboration (validation maintains control)

Category Summary

Principle Maturity Matrix

Key Takeaways

1. Tests before code - Write tests first; AI implements against specifications
2. Same standards apply - No quality shortcuts because “AI wrote it”
3. Security is non-negotiable - Treat AI as untrusted contributor
4. Validate continuously - Don’t wait until the end to find issues
5. Human accountability remains - Developers own all quality outcomes

Next Steps

License