Sonar aims an agent at the flaws where the code does exactly what it was told

The load-bearing word is "confirmed". Sonar says every candidate issue is investigated and proved out before a developer ever sees it ^[5], and that each finding arrives with its discovery path attached ^[6]. That is the difference between a tool that hands you a suspicion and one that hands you a reproduction, and it is the only version of this workflow that survives a sprint planning meeting.

Where I would push is the source of intent. The agent traces how code, data and a user's identity move through an application, forms a theory about where the implementation drifted from what the feature was meant to do, then goes looking for proof ^[4]. Intent has to come from somewhere, and the announcement does not name a source beyond the codebase itself and Sonar's playbooks, which are multistep sequences of security prompts encoding the company's own application security expertise ^[7][19]. That is generic knowledge of how a checkout flow or a tenancy boundary is supposed to behave, not knowledge of what your team agreed this feature would do. Expect strength on the recurring shapes and less on the rules peculiar to your domain. A user opening another customer's records is a shape anybody can describe ^[3]. The pricing exception your finance lead asked for in March is not.

The calendar is short for a product built on pre-verification. Beta opened on July 9 to SonarQube Cloud Enterprise customers ^[13], and general availability landed 49 days later ^[16]. In that window Sonar has published no precision figure and no count of what the alpha and beta actually turned up ^[18], so the accuracy that the whole triage model depends on is currently a claim.

Two things decide whether this earns a pilot slot. First, whether each sensitive feature has a written record of what it was supposed to do that somebody other than its author can check against, such as a ticket or an acceptance test. Second, whether one named person has the standing to hold a release on a confirmed access-control finding.

Both true, and you can start retiring some of the hand review this is meant to absorb ^[11]. Written intent but no authority, and what you own is a well-documented list of routes into other customers' data, sitting in a queue that has a groomer rather than an owner. Authority but no written intent, and triage time goes on arguing about whether the behaviour was deliberate. Neither, and the purchase lengthens the backlog without making the product safer.

Sonar is careful to call this an addition to its existing static analysis rather than a replacement for it ^[12], and the same plainness applies to the rollout: the pitch is detection, and what arrives on Monday is a second stream of findings into a list somebody already answers for. Teams that clear that list will get leverage out of it, and teams that do not will get a better-documented account of what they are not fixing.