Tag

#governance

Tagged “governance”

6 articles

GitHub takes rule insights up a level: bypass counts across the whole org

GitHub's rule insights dashboard is in public preview at the organization level, adding aggregated ruleset evaluation metrics, a top-repos-by-bypass view, filters and a CSV export. Platform teams that already run rulesets as a gating primitive get a single pane for who is actually going around them.

Aug 22, 2026 · Maya Okonkwo Supply-chain security

Docker argues AI agent security is a systems problem, not a review problem

A Docker blog post citing an OpenAI/Hugging Face incident with 17,600 attacker actions says human review can't scale to agent-speed CI, and calls for controls that constrain, observe and govern agents at machine speed.

Aug 20, 2026 · Tomás Vega Security & supply chain

The pipeline is your last honest reviewer for agent-authored change

A DevOps.com opinion piece argues that when coding agents open pull requests faster than humans can read them, the CI/CD pipeline (not the reviewer) has to be the control plane for AI-authored change.

Aug 15, 2026 · Tomás Vega Identity and access

Anthropic swaps per-developer Claude Code secrets for an OIDC gateway

Anthropic shipped a self-hosted Claude apps gateway that runs Claude Code on Amazon Bedrock and Google Cloud without per-developer cloud credentials, federating identity through Google Workspace, Microsoft Entra ID, Okta or any standards-compliant OIDC provider.

Jul 5, 2026 · Tomás Vega Runners & infrastructure

GitHub lets org admins switch off the default hosted runner labels

Organizations on Actions can now disable standard hosted runner labels such as `ubuntu-latest` at the org level, per the June 25 changelog. The toggle turns the default runner pool from an implicit allowlist into a catalogue platform teams have to maintain.

Jun 28, 2026 · Maya Okonkwo Security & supply chain

HCP Packer's enforced provisioners turn golden-image policy into a contract teams can't quietly skip

HashiCorp has added enforced provisioners to HCP Packer, letting platform and security teams centrally pin mandatory build steps onto every downstream image rather than trusting that the wiki page got read. The mechanism is the easy part; deciding whether your org actually wants policy this loud is the harder one.

Jun 17, 2026 · Tomás Vega