Policy-Gated Authority for AI Agents in DevSecOps

Under what evidence, environmental, sensitivity and authorization conditions should an AI software-engineering agent be permitted to move from proposing an action to performing a consequential DevSecOps action?

Why This Problem Matters

AI-assisted software engineering can produce recommendations, patches and operational requests, but generation capability does not itself determine whether an action should be allowed to affect a consequential DevSecOps pipeline. The project focuses on the decision boundary between an agent’s capability to propose an action and the authority to execute it.

Approach

The prototype represents agent-action requests using structured data and evaluates them with a frozen deterministic policy. Policy v1.0 separates authority into four representative classes: A0 — OBSERVE, A1 — PROPOSE, A2 — ISOLATED_EXECUTION and A3 — CONTROLLED_CHANGE.

Governance outcomes are ALLOW, REQUIRE_HUMAN_APPROVAL, ABSTAIN and BLOCK. The implementation checks action classification, required evidence, prohibited capabilities, authorization conditions and human-approval requirements, and records explicit reason codes and JSONL audit evidence.

Architecture

The implementation keeps policy specification, evaluation inputs, deterministic decision logic, scenario evidence and audit output separate. The design intentionally does not include an LLM or autonomous coding agent in v1.0; it evaluates structured synthetic requests against the governance policy.

Evaluation

Policy v1.0 was frozen before the verified implementation. The repository contains a predefined corpus of 15 synthetic governance scenarios and automated regression tests.

The verified implementation reports:

• 62 automated tests passed;
• 15 predefined scenarios evaluated;
• 15 expected outcomes matched;
• reproducible CLI execution and JSONL audit output.

These results establish consistency with the frozen policy and predefined scenarios. They are not measurements of real-world attack prevention or production-agent safety.

Results / Evidence

The project provides evidence that the deterministic implementation produces the expected Policy v1.0 outcomes for the predefined scenario set and preserves explicit reason codes and audit records for each decision.

My Contribution

This portfolio presents the project as technical-governance work by Yasir Siddiq and Sadaf Anwar. The associated public policy memo is also authored by Yasir Siddiq and Sadaf Anwar. Contribution boundaries beyond the public project record are not expanded here.

Limitations

Version 1.0 does not include a live LLM agent, autonomous coding, production credentials, production IAM integration, Kubernetes, formal verification, cryptographic evidence provenance or a real production deployment. It does not establish that the policy is universally optimal or compliant with any particular regulation or standard.

Reproducibility

The repository documents a verified implementation commit, frozen policy specification, synthetic scenario corpus, CLI commands and automated tests. The public repository is the reproducibility source for the current v1.0 artifact.

Current Status

The minimum deterministic prototype is implemented and integrated into the repository’s main branch. Policy v1.0 is treated as frozen for the verified implementation.