7. Software Layer
Admitting AI-generated software through explicit behavioral, structural, and operational invariants.
KSA decision chapter
Vision, execution, and evidence
8. Deployment Playbooks
Vision 2030 & Sovereignty
Secures the software pipeline for Saudi AI Software Factories, ensuring generated ministry workflows and database schemas are verified before deployment.
Software Supply-Chain Layer
AI-generated software changes the software supply-chain problem. When models can rapidly generate code, infrastructure-as-code, workflow logic, policies, and configurations, the strategic bottleneck is no longer producing candidate implementations. The bottleneck is deciding which generated artifacts are admissible into national or regulated production systems.
Earlier chapters focused on runtime governance. AI also changes how software is written: KSA platforms will use generative AI to write code, workflows, policies, adapters, and infrastructure templates. Generated implementation is abundant; admissibility is scarce. PDD provides the admission-control layer that governs whether artifacts enter production [1].
Why AI-Generated Software Changes the Control Point
Traditional governance assumes code is expensive to write. AI shifts the bottleneck from creation to admission: which candidate is safe, compliant, operable, and compatible with national infrastructure constraints? Examples include infrastructure-as-code, ministry workflow automation, data transformations, smart-city rules, compliance logic, generated adapters, remediation scripts, and deployment manifests.
The PDD Principle
Definition
Protocol-Driven Development treats the protocol as the primary software artifact. Implementations are replaceable candidates that are admitted only if they satisfy the protocol's structural, behavioral, and operational invariants.
Compilation and model provenance are useful signals, but they are not sufficient admission criteria. An artifact is admitted only when it satisfies the protocol, turning AI-assisted software generation into a more governable acceleration path.
Three Classes of Invariants
| Invariant class | What it governs | KSA example |
|---|---|---|
| Structural invariants | Interfaces, schemas, resource boundaries, dependency shape, required fields, allowed integration patterns. | Generated government workflow can use approved identity, data, and service interfaces. |
| Behavioral invariants | Allowed state transitions, authorization logic, safety checks, fallback behavior, escalation conditions. | A citizen-service workflow routes high-impact approval through required policy and human review. |
| Operational invariants | Observability, rollback, rate limits, operational-impact limits, deployment constraints, evidence requirements. | AI-generated infrastructure-as-code includes rollback path, evidence hooks, and production-scope limits. |
The Admission Pipeline
- Protocol specification. The protocol defines required interfaces, invariants, policies, evidence obligations, and operational constraints.
- Generated candidate artifact. A model or agent generates code, IaC, workflow logic, configuration, policy rules, or integration adapters.
- Static and structural validation. The artifact is checked for schemas, interfaces, dependencies, approved resources, and integration boundaries.
- Behavioral validation. The artifact is evaluated against allowed state transitions, authorization rules, escalation paths, and safety constraints.
- Operational validation. The artifact is checked for observability, rollback, rate limits, deployment scope, and evidence hooks.
- Evidence bundle. The admission process produces evidence describing the protocol version, checks performed, results, approvals, and deployment constraints.
- Deployment contract. If admitted, the artifact enters deployment under a bounded contract linked to runtime governance.
How PDD Links to ASCP, OpenKedge, and VAI
PDD is pre-deployment governance; ASCP and OpenKedge govern runtime actions; VAI records evidence before, during, and after execution. A generated artifact admitted by PDD can carry evidence into the runtime layer, where later actions are governed and replayed.
KSA Institutional Mapping
| KSA environment | Generated artifacts | PDD governance requirement |
|---|---|---|
| HUMAIN-style AI Cloud | Infrastructure-as-code, cluster automation, model-serving configuration, SRE scripts. | Admit artifacts with rollback, operational-impact limits, evidence hooks, and approved cloud interfaces. |
| DGA-style Digital Government | Citizen-service workflows, permit routing logic, document verification flows, agency integration adapters. | Apply policy, approval, privacy, escalation, and replay invariants before deployment. |
| SDAIA-style Data Platforms | Data pipelines, access logic, analytical workflows, transformation scripts. | Apply data classification, context minimization, authorized access, and evidence requirements. |
| NEOM-style Smart Cities | Digital-twin automation rules, mobility/energy/logistics optimization logic, facility scripts. | Use simulation validation, safety thresholds, operational rollback, and physical-action constraints. |
| Regulated Sectors | Healthcare triage workflows, financial compliance logic, energy operations scripts, logistics optimizers. | Apply sector-specific invariants and regulator-facing evidence before production. |
| Saudi AI Software Factories | Code, tests, deployment manifests, integrations, policies, and operational workflows. | Use protocol admissibility as the standard entry point for generated software delivery. |
What PDD Does Not Replace
PDD does not replace human engineering. It does not catch every bug. It does not force you to use AI for all code.
It simply creates a firm boundary: demonstrate that the artifact satisfies the protocol before it enters production.
Strategic Value for Saudi Arabia
PDD can help KSA scale AI-assisted software delivery across government software factories, AI cloud operations, smart-city platforms, and regulated sectors. It gives procurement teams a way to request admissibility evidence and gives local integrators clear protocol targets.
PDD governs what enters the system. ASCP and OpenKedge govern what acts inside it. The next chapter brings these layers together through concrete KSA deployment playbooks: HUMAIN-style AI cloud operations, SDAIA-style data governance, DGA-style public administration, NEOM-style smart-city digital twins, regulated sectors, and Saudi AI software factories.
References
- [1]Jun He and Deying Yu. Protocol-Driven Development: Governing Generated Software Through Invariants and Evidence. 2026. arXiv