How Docusign is leaning in on AI (and code review and champions)

Docusign’s CTO Sagnik Nandy sees AI as a time-saver, an output accelerator…and a chainsaw.

AI can lop time and effort off tasks, but still requires a living being to approve the cuts—especially when integrating AI tools into your infrastructure.

“A human still is responsible for the chainsaw,” Nandy told us.

The agreement-management company has been proud of its AI assistance lately. Docusign’s CTO claims that AI has helped create around three-quarters of the organization’s new code, including internal tools, individual features, and platform enhancements. In the company’s most recent earnings call, CEO Allan Thygesen saw the increased output of AI-assisted shipped code as a way “to gain efficiencies and boost productivity in both engineering and customer-facing teams.”

A couple of years ago, Nandy said, the company’s use of AI was minimal and “vanilla.” His team wanted to scale adoption. “We really want to lean in. We want to do this big. We want to do this right, and we want to do this in a sustainable way,” he said. “We wanted to add clear value, leveraging AI tools.”

Nandy spoke with us about essential guardrails Docusign put in place before pulling the chain on the power tool.

We are the…To avoid a “top-down” approach, Nandy sponsored an “AI champions” program. Though Docusign has over 1,000 engineers, according to the CTO, five or so senior champions created structural guardrails around AI usage. That involved gathering feedback from about 75 “AI multipliers”—approximately one representative per team.

“Responsible acceleration” guidelines included proof that code was tested before review, AI labels on pull requests, and mutation testing, or introducing small code changes and seeing if they are detected.

With execs spending their earnings calls bragging about their AI gains, as IT Brew has reported, AI champions programs have become a popular starting point for companies leaning into AI.

When IT Brew spoke to him in January, for example, Don Murray, co-founder and CEO of Safe Software, had appointed 18 champions—enthusiastic early adopters—throughout his company. His AI advocates shared use cases, brainstormed ideas, and maintained a “direct line to IT” for implementation decisions.

At the time of the interview, Murray said the organization had majority AI adoption, including the sales, marketing, and development team.

Developers corrected code more quickly and increased their productivity, according to Murray, thanks to Anthropic’s Claude: “AI is an assistant, not an authority, because if you really know your field, then you can quickly identify where AI is adding value, or where maybe it’s getting confused.”

More code = more code review. And AI can get confused—like when it deletes a database. Preventing AI slop and flop requires code review.

In Docusign’s case, that meant taking advice from its AI champions and building a custom code-review agent that encodes important boundaries and rules, like how databases can be accessed. Human reviewers remain accountable for code that reaches production.

Docusign deployed both coding tools and internally built agents. One recent automation, according to Nandy, actively monitors telemetry systems for error signals. Instead of waiting for an engineer’s Jira ticket describing a requested change, the agent initiates a workflow; hands off the fix and testing to an internal coding agent; and prepares it for human review, the CTO shared in a follow-up email.

In an April post on the company’s blog, Docusign Principal Engineer Ahmed Jolani described an autonomous coding “elf,” where engineers can describe the change they need in a Slack workflow; then the spritely bot writes the code, runs tests, and submits a pull request for review.

Common in Docusign’s agentic buildouts is that space for assessment, so the AI chainsaw doesn’t start shredding a codebase.

And human review. Andrew Southall, founder of analytics firm Truly Digital, recently offered advice for those using AI coding assistants:

• Build a box. Keep your large language model in a contained, sandboxed environment, and restrict an LLM’s access to databases or repos.
• Enforce strong system prompts. These non-negotiables can enforce company-specific standards like never hardcoding credentials or keeping files to a certain length.
• Narrow the scope. Point the model at specific directories and use the LLM for well-defined tasks.
• Check your work. Be ready for human review.

AI should not be the final decision-maker for merging new code, according to Kevin McDonald, principal consultant at tech consultancy Hylaine: “You want somebody who has leadership or has a lot of experience to be the gatekeeper there, and an AI isn’t really going to be that person.”

Nandy, providing that leadership, is one of many human gatekeepers ready to juggle the chainsaws. “The engineer is still responsible for code. So, even when AI is writing, the responsibility is not with AI,” he said.