AI agent governance for the regulated SDLC

Use AI coding agents
where you normally can’t.

AutoDevOps records what your AI coding agents do, pauses risky actions for human approval, and turns the record into audit-ready evidence.

Request a demoInstall the CLI

Verification portal

Fincard demo · Demo dataCustomer cloud

Executive control plane

Governed AI activity

Audit chain current

Governed sessions

2Fincard demo

Denied actions

1Before execution

Approved decisions

2Internal paths

Reported cost

$63.42Current month

Risk prevented

Public-egress probe

Denied

Policy stopped a public curl action before the restricted worker ran it.

Risk score97 · High

Control posture

Customer-owned boundary

Validated path
  • AWS worker boundaryIn scope
  • Model routeBedrock
  • Policy version2026-04-20

See adoption, risk, approval pressure, and operating cost in one control surface.

Compliance controls mapped today

Model Inventory & Origin LineageSR 11-7
Conceptual Soundness & Intent TraceSR 11-7
Outcomes Analysis & Ongoing MonitoringSR 11-7
Model Risk Officer Threshold Sign-OffSR 11-7
Pre-Production Change Blast RadiusDORA
Third-Party AI Tool Egress & Boundary GateDORA
Fail-Closed Operational ResilienceDORA
Technical Documentation & Architecture SpecsEU AI Act
Automated Tamper-Evident Event LoggingEU AI Act
Human-in-the-Loop Oversight & RationalesEU AI Act
Cybersecurity & Data Redaction DefenseEU AI Act
Dual-Control & Separation of DutiesFFIEC
Attributed SDLC Code ProvenanceFFIEC
Continuous Agent Trust & Risk ScoringISO 42001 / SOC 2
Role-Based Authentication & Signed IngestISO 42001 / SOC 2
Cryptographic Evidence Package VerificationISO 42001 / SOC 2

Reference mapping across SR 11-7, DORA, EU AI Act, FFIEC, and ISO 42001 / SOC 2. Full control detail at /controls.

Works with the tools that run your agents

Claude Code, Codex, and Cursor are supported today with one install command; anything else emits through the SDK.

Agent actions only

No keystrokes, no screen capture

Pre-production

Laptop, CI, and cloud workers. Never production

Your cloud

Prompts and source never leave your account

Allow · Confirm · Block

Risky actions wait for a person

Get started

Two commands to get on the record.

The CLI installs into agents your team already runs; the portal approves and exports evidence.

Claude Code

bash
npm install -g @autodevops/verifier
verifier install --harness claude-code --mode telemetry
  • Hooks in .claude/settings.json record every session, prompt, and tool call.
  • The MCP server lets a session attach its spec.

verifier harness doctor --harness claude-code verifies the receipt and installed files.

Codex

bash
npm install -g @autodevops/verifier
verifier install --harness codex --mode telemetry
  • Writes .codex/hooks.json and registers the MCP server in .codex/config.toml.
  • Records sessions, prompts, file edits, and shell commands once the config is trusted.

verifier harness doctor --harness codex verifies the receipt and installed files.

Cursor installs the same way with --harness cursor; Copilot CLI is roadmap. Events post once your portal credentials are set; approval gates ship in the customer-cloud enterprise distribution.

How it works

Always on the record. Never in the way.

The same four steps, from agent action to auditor.

  1. 01

    Capture

    Every tool call and model call, recorded as it happens. Never the developer’s screen.

  2. 02

    Decide

    Policy decides allow, confirm, or block before the action runs.

  3. 03

    Record

    An append-only audit log in your own storage.

  4. 04

    Prove

    Evidence your auditor verifies offline — no raw prompts or source.

Control surface

One config. Same gate everywhere.

One policy file sets hooks, gates, provider, and budgets, versioned in the repo like code.

yaml
hooks:
  pre-commit: [lint, security-scan]
governance:
  default: confirm
providers:
  bedrock:
    region: us-east-1
budgets:
  per_commit_tokens: 5000

Policy engine

Deterministic rules decide — never an LLM’s interpretation. Prior approvals let similar actions flow.

Audit trail

Every decision replayable with context. PR summaries bind to the same record, local or worker.

Agent analytics

Activity, cost, approvals, and risk per developer, team, and agent, from the audit ledger.

Budgets, not surprises

Token and cost limits per commit, day, and month; the run stops with the reason on record.

Inside the regulated SDLC

Built for teams that answer to examiners.

The record behind approvals becomes the reports model-risk and compliance leaders ask for.

Intent fidelity

The spec attaches to its session; a deterministic score answers: did the agent build what was asked?

See it in the SR 11-7 mapping →

Cognitive debt

How much agent-written change lands without recorded rationale — and whether the team still understands what it ships.

See it in the ISO 42001 mapping →

Regulatory reporting

SR 11-7, FFIEC, DORA (EU operational resilience), EU AI Act, ISO 42001, and SOC 2 — each mapped to evidence you can hand an auditor.

Browse all six mappings →

Proof surface

Evidence your auditor can verify offline

The portal view and the export are the same hash-bound record.

Operator view · demo data

FinCard demo

Verification portal overview for the fictional FinCard demo workspace, showing agent health and pending decisions.

A demo workspace (FinCard, a fictional bank): sessions, approvals, and audit in one surface.

Evidence package manifest (redacted)

json
{
  "schema": "autodevops.evidence_package.v1",
  "packageId": "pkg_7f2a…c91e",
  "manifestSha256": "a4e8…9b2f",
  "redactionPolicy": "no_raw_prompts_or_source",
  "chapters": [
    "session_summary",
    "approval_decisions",
    "agent_run_audit_refs",
    "provenance_query_chain"
  ],
  "exportChain": {
    "previousHash": "c3d1…8a04",
    "entryHash": "f9b0…2e17"
  }
}
  • Session and approval history, never raw transcripts
  • Every signal traces back to an audit record
  • Mapped to the controls your regulators name
See the control mappings →

Deployment

Inside your cloud. Owned by you.

AWS is the validated path today; Azure and Google Cloud adapter tracks are roadmap.

Amazon Web Services

Validated

Bedrock model calls on your own AWS credentials; IAM-scoped workers in private subnets.

Microsoft Azure & Google Cloud

Roadmap

Adapter code exists for Azure OpenAI, Functions, Vertex AI, and Cloud Run. Not yet customer-validated.

See what your auditor will see

A guided walkthrough on the validated AWS path.

Request a demoGitHub