The agent-native software factory
Guides on building, governing, and scaling an agent-native software factory, plus write-ups of the podcasts and talks behind the ideas.
Within Security & Governance
AI Coding Agents
Security
Webhook verification for coding agent changes
Webhook verification for coding agent changes requires raw-body signature checks, replay defenses, secret rotation, and negative tests before merge.
Read articleEnterprise AI
Security
Least-privilege access for coding agents
Least-privilege access for coding agents limits files, commands, networks, and credentials to what each task needs. Use this review checklist before granting autonomy.
Read articleComparisons
Enterprise AI
Factory vs Cognition for enterprise agent controls
Compare Factory vs Cognition on administering Droid and Devin: user access, model policy, command permissions, automation ownership, and audit records.
Read articleAI Coding Agents
Governance
Audit trails for coding agent changes
A coding agent audit trail connects identity, intent, tool activity, validation, review, and deployment. Learn what evidence to retain without collecting unnecessary data.
Read articleFactory Private
Agent Governance
AI agent controls for private development networks
AI agent controls for private networks need enforceable permissions, sandboxing, managed model policy, and review gates. Build a testable policy for Droid.
Read articleAI Coding Agents
Security
CORS checks for agent-generated web services
CORS testing for agent-generated services verifies allowed origins, preflight handling, credentials, caching, and failure behavior in browsers.
Read articleAI Coding Agents
Security
Authorization tests for coding agent changes
Authorization tests for coding agent changes require denied-path coverage, object-level cases, policy fixtures, and evidence at the enforcement point.
Read articleFactory Private
Security Remediation
Private AI security remediation with review gates
Private AI security remediation should connect a validated finding to a bounded fix, regression tests, and approval. Keep evidence and execution inside the approved boundary.
Read articleAI Coding Agents
Security
Tenant isolation tests for coding agent changes
Tenant isolation testing for coding agent changes verifies authorization, storage boundaries, cache keys, and background jobs before shared services ship.
Read article
