ProvenanceCode
Use cases
DevOps automation agent
🚀 DevOps Governance
Your CI/CD pipeline moves fast. Policy Gateway makes production deployments human-approved.
AI DevOps agents can provision infrastructure, trigger deployments, rotate secrets, scale services, and modify production configuration — autonomously, at speed. Policy Gateway enforces a human approval gate on every production-bound action while letting dev/staging operations run without friction.
How it works
Autonomous in dev. Human-gated in prod.
01
Agent identifies infrastructure action
The DevOps agent detects a load spike and determines a scale-up is needed. It generates a ProvenanceCode artifact declaring its intent: scale the production ECS service from 4 to 20 replicas. The artifact includes its risk self-assessment.
02
Policy Gateway classifies: env=production → gate
Your policy rule fires: any action targeting the production environment requires human approval. The agent is held. The on-call platform lead receives a notification with full context — what the agent wants to do, why, and the risk assessment.
policy rule:
if env == "production" → require_human_approval
if env == "staging" → auto_approve
if env == "production" → require_human_approval
if env == "staging" → auto_approve
03
Platform lead approves with full context
The reviewer sees the intent, the current load metrics the agent cited, the proposed change, and the risk assessment. One click to approve. Their identity and timestamp are sealed into the record.
Approved · identity-bound · timestamp sealed
04
Executor acts within approved scope · result signed
The Secure Runtime Environment receives the signed approval, validates it, executes the ECS update, and returns a signed result. The provenance record is sealed — the load data, the agent's reasoning, the approval, and the execution outcome are cryptographically linked.
Production scaled · provenance sealed · SIEM logged
Why DevOps teams use this
Autonomous ops. Human-controlled blast radius.
Dev/staging: fully autonomous
Non-production environments run without gates. The agent can provision, deploy, and tear down freely in dev and staging — zero overhead on the 90% of operations that don't touch production.
Production: always human-gated
Any operation touching production — deployments, scaling, secret rotation, config changes — requires a named human approval. The policy is yours to define. The enforcement is deterministic.
Full incident reconstruction
When something goes wrong in production, you need to know what changed, when, who approved it, and what the agent cited as its reasoning. The provenance record answers all of those questions immediately.
SIEM-native audit trail
Every infrastructure action — auto-approved or human-gated — produces a structured JSON record that flows directly into your SIEM. Your SOC sees all AI-initiated infrastructure changes in real time.
Cost anomaly gate
Add a policy rule: any resource provisioning action above a defined cost threshold requires human approval. The agent can't accidentally spin up a GPU cluster that runs unnoticed for a week.
AWS-native deployment
Policy Gateway deploys alongside your existing AWS infrastructure. Available via AWS Marketplace. Integrates with IAM, CloudTrail, ECS, Lambda, and EC2 out of the box.
Get started
Governed DevOps agents in your AWS stack.
We work with a small number of platform teams on pilot deployments. Tell us about your infrastructure setup and your production change control requirements.