AI agent governance for the regulated SDLC

Every agent. Every action.
On the record.

AutoDevOps captures what Claude Code, Cursor, and Codex do in your SDLC — every session, tool call, and decision — and turns it into evidence an examiner can verify. Approval gates ship in the customer-cloud distribution.

Request a demoInstall the CLI

Verification portal

Fincard demo · Demo dataCustomer cloud

Executive control plane

Governed AI activity

Audit chain current

Governed sessions

2Fincard demo

Denied actions

1Before execution

Approved decisions

2Internal paths

Reported cost

$63.42Current month

Risk prevented

Public-egress probe

Denied

Policy stopped a public curl action before the restricted worker ran it.

Risk score97 · High

Control posture

Customer-owned boundary

Validated path
  • AWS worker boundaryIn scope
  • Model routeBedrock
  • Policy version2026-04-20

See adoption, risk, approval pressure, and operating cost in one control surface.

Integrations

Fits into agents you already run.

The public CLI installs telemetry into Claude Code, Cursor, and Codex — no proxy in the model call path.

Claude Code, Codex, and Cursor are supported today with one install command. Copilot CLI is roadmap. Other harnesses can be wired through the JS/TS connector helper — they do not ship a hook pack.

Install the connector

terminal
npm install -g @autodevops/verifier
verifier install --harness claude-code --mode telemetry

Telemetry mode records session, prompt-submit, and tool-use events. Prompt text is opt-in. The MCP server lets a session attach its spec.

  • Claude Code writes .claude/settings.json
  • Cursor writes .cursor/hooks.json
  • Codex writes .codex/hooks.json and .codex/config.toml

Confirm it’s on the record

terminal
verifier harness doctor --harness claude-code

The doctor command verifies the receipt and installed files; events post once your portal credentials are set. Approval gates ship in the customer-cloud enterprise distribution.

Codex installs with verifier install --harness codex --mode telemetry and Cursor with --harness cursor. Copilot CLI is roadmap.

How it works

Always on the record. Never in the way.

The same four steps, from agent action to auditor.

  1. 01

    Capture

    Session, prompt-submit, and tool-use events, recorded as they fire. Never the developer’s screen.

  2. 02

    Decide

    In the customer-cloud distribution, policy decides allow, confirm, or block before the action runs.

  3. 03

    Record

    An append-only audit log in your own storage.

  4. 04

    Prove

    Evidence packages verify offline — no raw prompts or source.

Control surface

One policy file. Same contract everywhere.

Governance, sensitivity, provider, and budgets — versioned in the repo. The same file applies locally, in CI, and in cloud workers.

yaml
governance:
  enabled: true
  mode: enforcement
sensitivity:
  enabled: true
  confirm_threshold: 70
providers:
  bedrock:
    region: us-east-1
budgets:
  per_commit_tokens: 5000

Policy engine

Deterministic rules decide — never an LLM’s interpretation. Prior approvals let similar actions flow.

Audit trail

Every decision replayable with context. PR summaries bind to the same record, local or worker.

Agent analytics

Activity, cost, approvals, and risk per developer, team, and agent, from the audit ledger.

Budgets, not surprises

Token and cost limits per commit, day, and month; the run stops with the reason on record.

Inside the regulated SDLC

Built for teams that answer to examiners.

The record behind approvals maps to the reports model-risk and compliance leaders ask for. Reference mapping, not a certification.

Intent fidelity

The spec attaches to its session; a deterministic score answers: did the agent build what was asked?

See it in the SR 11-7 mapping →

Cognitive debt

How much agent-written change lands without recorded rationale — and whether the team still understands what it ships.

See it in the ISO 42001 mapping →

Regulatory reporting

SR 11-7, FFIEC, DORA, EU AI Act, ISO 42001, and SOC 2 — a reference mapping to evidence you produce, not a certification.

Browse all six mappings →

Compliance controls mapped today

Model Inventory & Origin LineageSR 11-7
Conceptual Soundness & Intent TraceSR 11-7
Outcomes Analysis & Ongoing MonitoringSR 11-7
Model Risk Officer Threshold Sign-OffSR 11-7
Pre-Production Change Blast RadiusDORA
Third-Party AI Tool Egress & Boundary GateDORA
Fail-Closed Operational ResilienceDORA
Technical Documentation & Architecture SpecsEU AI Act
Automated Tamper-Evident Event LoggingEU AI Act
Human-in-the-Loop Oversight & RationalesEU AI Act
Cybersecurity & Data Redaction DefenseEU AI Act
Dual-Control & Separation of DutiesFFIEC
Attributed SDLC Code ProvenanceFFIEC
Continuous Agent Trust & Risk ScoringISO 42001 / SOC 2
Role-Based Authentication & Signed IngestISO 42001 / SOC 2
Cryptographic Evidence Package VerificationISO 42001 / SOC 2

Reference mapping across SR 11-7, DORA, EU AI Act, FFIEC, and ISO 42001 / SOC 2. Full control detail at /controls.

Proof surface

Evidence your auditor can verify offline

Portal views compute from the ledger. The export is the hash-bound package an auditor verifies offline.

Operator view · demo data

FinCard demo

Verification portal overview for the fictional FinCard demo workspace, showing agent health and pending decisions.

A demo workspace (FinCard, a fictional bank): sessions, approvals, and audit in one surface.

Evidence package manifest (redacted)

json
{
  "schema": "autodevops.evidence_package.v1",
  "packageId": "pkg_7f2a…c91e",
  "manifestSha256": "a4e8…9b2f",
  "redactionPolicy": "no_raw_prompts_or_source",
  "chapters": [
    "session_summary",
    "approval_decisions",
    "agent_run_audit_refs",
    "provenance_query_chain"
  ],
  "exportChain": {
    "previousHash": "c3d1…8a04",
    "entryHash": "f9b0…2e17"
  }
}
  • Session and approval history, never raw transcripts
  • Every signal traces back to an audit record
  • Mapped to the controls your regulators name
See the control mappings →

Deployment

Inside your cloud. Owned by you.

AWS is the validated path today; Azure and Google Cloud adapter tracks are roadmap.

Amazon Web Services

Validated

Bedrock model calls on your own AWS credentials; IAM-scoped workers in private subnets.

Microsoft Azure & Google Cloud

Roadmap

Adapter code exists for Azure OpenAI, Functions, Vertex AI, and Cloud Run. Not yet customer-validated.

Security

Trust is non-negotiable.

Designed for your cloud boundary. AWS is the validated path; evidence packages verify offline.

Agent actions only
No keystrokes, no screen capture.
Pre-production scope
Laptop, CI, and cloud workers. Never production traffic.
Your cloud, your record
BYOC: prompts and source stay in the customer account.
Allow · Confirm · Block
Risky actions wait for a person when enforce mode is on.
View control mappings

Start putting your agents on the record.

A guided walkthrough on the validated AWS path — capture, approval, and the evidence file.

Book a demoGitHub