AI Agent Guide
How to Build SaaS Features with AI Coding Agents
AI coding agents are fast at generating code. They are slow at trust. VerdantStack gives them a foundation they can trust — 298 tests, machine-readable docs, and production-hardened patterns. Here's how to use that.
The AI coding landscape in 2026
AI coding tools are now a daily reality for most developers. The DORA 2025 report shows widespread adoption. But the tools have a gap: they generate code fast, but they don't generate trust. That's what VerdantStack provides.
What AI does well
- Generate boilerplate from prompts
- Add features to known patterns
- Write inline code suggestions
- Refactor across multiple files
What AI does poorly
- Make architectural decisions
- Enforce security invariants
- Write comprehensive tests
- Understand edge cases
VerdantStack fills the gap: it provides the architecture, the security patterns, and the tests — so the AI tools can do what they're good at.
Supported AI tools
Claude Code
Guide →Context: AGENTS.md
Deep codebase understanding, respects invariants, multi-file edits
Open terminal in the starter directory — reads AGENTS.md automatically
Cursor
Guide →Context: AGENTS.md
Composer (multi-file edits), inline suggestions, codebase indexing
Open the folder in Cursor — reads AGENTS.md automatically
GitHub Copilot
Context: AGENTS.md
Inline suggestions, chat, code review
Install the extension — reads AGENTS.md automatically
Replit Agent
Context: AGENTS.md + llms.txt
Full-stack generation, deployment built-in
Import the repo — reads AGENTS.md for context
The five principles
1. Give the agent a known foundation, not a blank canvas
AI tools are fast at generating code. They are bad at making architectural decisions. A starter kit gives them a working foundation — auth, RBAC, database, tests — so they add features instead of inventing architecture.
2. Use context files as guardrails, not documentation
AGENTS.md is not just docs — it is a constraint file. The agent reads it as rules. "Do not modify the auth model" in AGENTS.md is a guardrail. "Auth uses scrypt + hashed sessions" is documentation. Put both in the file.
3. Test everything the agent generates
AI code without tests is a liability. AI code with 298 tests is a foundation. After every agent-generated change, run the test suite. If the tests pass, you have a verified feature. If they fail, the agent broke an invariant.
4. Track what changed with the audit log
The append-only audit log captures who did what and when. When an agent makes changes, the log shows exactly what was modified. This is your "undo" trail — not a technical undo, but an accountability trail.
5. Keep the RBAC system as the single source of permission truth
Never let an agent create a parallel permission system. The RBAC hierarchy (owner > admin > member) is the single source of truth. When an agent adds a feature, it should use the existing role checks — not invent new ones.
The workflow
Start with the foundation
Clone the starter, verify the tests pass, click through the live demo. Understand what you have before you add to it.
Describe the feature in plain language
Tell the AI tool what you want: "Add a team invite flow" or "Add a new role called editor." Be specific about the behavior, not the implementation.
Let the agent generate the code
The agent reads AGENTS.md and the API reference. It uses the existing patterns — Drizzle for DB, scrypt + hashed sessions for auth, the RBAC system for permissions.
Review the diff
Look at what changed. Did the agent touch files outside the scope? Did it modify the auth model? Did it add a new dependency? These are red flags.
Run the test suite
npm test. If the tests pass, the feature works. If they fail, the agent broke something — revert and try again with more specific constraints.
Check the audit log
The audit log should show the changes. If the agent bypassed the audit system, the feature is incomplete — fix the audit integration before shipping.
Frequently asked questions
Can I build a whole SaaS with just AI coding agents?
You can build the features. You cannot build the architecture — and that's what the starter provides. AI tools are fast at generating "add a password reset" on top of a known auth system. They are bad at building the auth system from scratch. The starter gives them the foundation; you add the features.
Which AI tool should I use?
All three major tools (Claude Code, Cursor, Copilot) work with the same starters. Claude Code is best for deep multi-file changes. Cursor is best for visual editing with the Composer. Copilot is best for inline suggestions. Use whichever you're most comfortable with — the starter works with all of them.
What if the agent breaks something?
Run the test suite. The 259–314 tests are your safety net. If the tests catch the break, revert the change and try again with more specific constraints in AGENTS.md. If the tests miss it, add a test for that case — the starter gets stronger.
Do I need to know how to code?
Yes. AI tools accelerate coding; they don't replace understanding. You need to read the diff, understand the changes, and verify the tests. The starter makes this easier — the patterns are consistent, the test suite is comprehensive, and the audit log tracks everything.
Will this work with future AI tools?
Yes. AGENTS.md is becoming a standard (Cloudflare, Google, and Vercel all support it). The starter's architecture is tool-agnostic. As new AI tools emerge, they will read the same context files. The foundation doesn't change.
What about security?
AI-generated code needs the same review as human-written code. The starter's security patterns (rate limiting, RBAC enforcement, session hashing, audit logging) are your baseline. When the agent adds a feature, it should use these patterns — not bypass them. The tests verify the security invariants.
Get started
Pick a starter, clone it, and start building with your AI tool of choice:
Related reading
Get in touch
Questions about the product, team licenses, or anything else? We'll respond within 48 hours.