Δ Delta
Constraint craft for AI-assisted code in regulated systems

Delta: Closing the
Specification Gap

Generation got cheap. Verification did not. This is the book on what you actually write to make AI-generated code survive a regulated production system.
Sandeep Dhuri Tech Lead · Two decades in financial services, healthcare & insurance
Abstract
AI coding assistants produce the statistically most likely code, not the code your domain requires. The distance between the two is the Specification Gap. Independent testing through 2026 found that roughly 45% of AI-generated samples introduce OWASP Top 10 vulnerabilities, and that the rate stayed flat across successive model generations — larger models were no safer. That is the shape of a specification problem, not a model problem. This book presents the Specification Frame: the constraint sentences that close the gap in enterprise, regulated-domain codebases — the content that goes inside a specification, rather than the tooling built around one.
Read the book — free See the argument
Free · no royalties · compilable code in .NET 9, Java 21, Python 3.12 & TypeScript
Not another prompt-engineering primer, and not a spec-driven-development tool guide. Those give you a container; this is about the constraint content that goes in it.
Figure 1

The same task, one missing constraint apart.

Unspecified prompt → likely output
// "sum the transaction amounts"
public double Total(List<Tx> t) =>
  t.Sum(x => (double)x.Amount);

Outcome: a $2,341.17 reconciliation shortfall, compounding silently below monitoring thresholds for 23 days. Passes review. Passes tests.

Specified prompt → correct output
// money is never a binary float
public Money<USD> Total(List<Tx> t) =>
  t.Aggregate(Money<USD>.Zero,
    (s,x) => s.Add(x.Amount));

Difference: one constraint sentence — "use Money<TCurrency> for all amounts; never double." Ten words.

The model was not wrong. It produced what was statistically most likely. The prompt asked for what was statistically most likely. That is the entire problem, stated precisely.

What the book contributes

Five named, original contributions.

I

The Specification Frame

A four-element prompt structure — role, context, task, constraints — that closes the domain, context, and constraint gaps simultaneously. Read the overview →

II

The Specification Gap

A three-component diagnosis — domain, context, and constraint gaps — of why capable models still produce domain-incorrect code.

III

The Evidence Brief

A six-section debugging protocol that turns "help, it's broken" into a systematic diagnosis, often before the prompt is sent.

IV

The Ten Laws

A unified, numbered set of structural truths for enterprise AI prompting that hold regardless of which model is used.

V

Regulated-domain practice, in existing codebases

HIPAA, PCI-DSS, GDPR, idempotency, money-types, and the AI security attack surface — applied where agents measurably struggle most: brownfield systems with undocumented conventions, not greenfield demos.

The book also includes 100+ compilable examples, 19 chapters, and 11 appendices spanning code generation, review, debugging, testing, MCP, security, and DevOps.

How to cite this work
Reference
Dhuri, Sandeep. (2026). Delta: Closing the Specification Gap: A Prompt Engineering Framework for Enterprise Software Teams. Acuity Press.
DOI
10.5281/zenodo.21584309
When citing a technique
"…using the Specification Frame technique described by Dhuri (2026)."

A BibTeX entry and the CITATION.cff file are available in the companion repository.

Read it

The most expensive line of code you'll ever ship

is the one an AI generated from a vague prompt on a quiet afternoon.

Download PDF (free) Download EPUB (free) Sample: Chapter 1

The EPUB is the recommended accessible edition (reflowable text, screen-reader friendly). Media: fact sheet.

Free · no account · no payment