Blog
AI on rails. Humans at the switch.
Writing on AI delivery governance. Every post here backs its argument with something you can check: a command, a real transcript, a cited number, or a policy rule that refuses to compile.
- CTO / Platform lead5 min read
The interesting part of a decision is what you turned down
A changelog tells you what a company built. It cannot tell you whether the shape was reasoned about or arrived at by accident, because both produce the same list of features. The useful record is the one that says what was decided against — reselling inference, auto-applying low-risk fixes, flattening the policy layers, exempting ourselves from our own gate. Four decisions, each with the tempting alternative we rejected.
Read the post - Platform lead / CISO6 min read
Your policy engine governs your pipeline. Ours governs the change
Most delivery platforms have had policy-as-code for years — Harness shipped OPA-backed Policy as Code in 2022, before we existed. But those engines were designed to govern the platform's own entities: pipeline configs, feature flags, infrastructure definitions. None of them was built to evaluate the content of a change an AI agent just proposed. That is a different object, and it needs the gate in a different place: between the agent and the pull request.
Read the post - CISO / VP Engineering5 min read
44% of AI code-generation tasks introduce a vulnerability. Your pipeline doesn't know which 44%
In Veracode's 2026 benchmark, 44% of AI code-generation tasks introduced a known security flaw, and AI now authors roughly half of all committed code. The usual answer is more scanning. Scanning tells you after the merge, at a volume nobody triages — and the telemetry shows review time and production incidents both climbing faster than throughput. What scales with agent output is a check that runs on every proposal before a human ever opens it.
Read the post - Platform lead6 min read
Prompts are not policy
The usual way teams control AI coding agents is a prompt — an AGENTS.md, a system preamble, a paragraph of standards. A prompt is a request, evaluated probabilistically, and it cannot be versioned into evidence, tested, signed, or proven to have gotten stricter. A policy bundle can be all four. The distinction is the difference between hoping and enforcing.
Read the post - Platform / Security engineering4 min read
Your AI code compiles. That is not the same as correct
AI-generated code now compiles at a near-universal rate while only 56% of generation tasks produce secure code. The gap between those two numbers is the problem: AI code increasingly looks right, compiles, and reads naturally while still carrying a security flaw. That is the failure mode human review is worst at catching, because nothing about it looks wrong.
Read the post - CISO / Head of Security5 min read
Shadow AI is shadow IT that writes code
Shadow AI is the unsanctioned use of AI tools inside an organization, and it is shadow IT with a shorter fuse: the output is not a spreadsheet in a personal Dropbox, it is code on its way to your cluster. Source code is now the largest category of sensitive data in generative-AI policy violations. The response that works is a governed path faster than the ungoverned one, not a stricter ban.
Read the post - CTO / VP Engineering5 min read
Your AI agent should not have merge rights
AI agents should not be able to merge code, because the merge is where accountability lives rather than where the AI's competence runs out. An agent cannot be accountable to an auditor or an incident review, so the approval step is the one part of software delivery that cannot be delegated. Everything upstream of it can.
Read the post
Prefer a reader? Subscribe via RSS.