Governed Software Evolution: Embedded Engineering Agents and the Curation of User-Originated Variability in Enterprise Applications

Enterprise applications are extended through a ticket queue: the people who hold the intent (domain experts) are separated from the people who hold the keys (developers) by a chain of translation steps that is slow, lossy, and economically unable to serve the long tail of small, team-specific needs. LLM-based coding agents make it technically feasible to collapse that chain by embedding an engineering capability inside the application itself, so that a procurement manager or a sales lead can extend the product by describing what they need. We argue that this is not primarily a code-generation problem but a variability-management problem, and that it breaks the central assumption of software product-line engineering: that variation points are declared at design time by an architect and that tenants configure within them. When extensions are generated bottom-up by thousands of domain experts at runtime, variation becomes unbounded and unanticipated, and the well-known failure mode of variant explosion is no longer a modelling risk but an operational certainty unless the organisation curates continuously. This position paper (i) identifies the assumption that agentic runtime extension breaks, (ii) proposes a reference architecture in which extensions are generated by an embedded agent, isolated per user, and bound to the host through a versioned extension contract and a capability-based permission model, (iii) proposes a tiered promotion pipeline — personal, team, enterprise — in which variability management becomes a continuous curation problem gated by an enterprise platform team, and (iv) lays out an evaluation design and the open problems, including semantic correctness against unstated intent, which we treat as a declared limitation rather than a solved problem. We position the proposal against end-user software engineering, self-evolving agents, agentic software engineering, and the citizen-development governance models already deployed in industry, and we are explicit about what is synthesis and what is new.

Position/vision paper. No system has been implemented, and no empirical results are reported.