Four control boundaries for agentic DevSecOps
Code generation is the easy part. The enterprise problem is controlling what happens after the model decides what it wants to do.
The problem
Model reasoning — inspect repository, propose a change, select a tool, explain intent.
Enterprise authority — identity, policy, CI/security gates, approval + deployment.
Do not collapse these two layers.
The four boundaries
The platform has four control boundaries. Every action crosses a boundary that can be logged, denied, reviewed, tested, or rolled back.
- Request — engineer / application
- Reason — Claude Code + Bedrock
- Authorize — Gateway + identity + policy
- Verify — CI/CD + sandbox
Evidence rail: model call · tool call · policy result · CI result · approval · deployment · health
Claude Code: treat the repository as the operating context
CLAUDE.md is the engineering contract, not a substitute for security enforcement. The workflow: Discover → Plan → Change → Validate → Pull request.
Repository rules that matter:
- Preserve protected security and deployment workflows
- Make the smallest viable change
- Run deterministic validation before proposing the PR
- Return the diff, evidence, remaining risk, and rollback steps
MCP + tools: narrow tools beat an unrestricted shell
Claude Code requests an operation → the Tool Gateway enforces a typed contract and policy → AWS/Git authorizes the target.
Blocked by design: arbitrary admin shell · broad inherited credentials · unregistered cloud actions
DevSecOps: the agent does not grade its own work
Build → unit + integration → IaC validation → SAST / SCA → secrets → approval → deploy. Independent gates decide whether the artifact moves forward. A model assertion never replaces a test result, scan result, policy decision, or deployment health signal.
Observability: an evidence chain, not a chat transcript
- Request — who asked + what changed
- Model — invocation + reasoning context
- Tool — operation + identity + policy
- Pipeline — tests + scans + artifact
- Decision — review + approval
- Runtime — deploy + health + rollback
The operating model: start bounded, scale on evidence
Agentic engineering becomes useful at enterprise scale when the controls are visible, independent, attributable, and measurable.
Claude Code + AWS controls + independent evidence = trust.
This is the short version of the ten control disciplines — see the 30-day challenge to build the reference project these four boundaries describe.