DevOps Veteran: AI Governance Needs Old Controls, Not New Ones

·3 views

A software professional with two decades of DevOps experience concluded, after writing thirteen posts on the topic, that AI governance requires no fundamentally new discipline. The same five core controls — blast radius, auditability, measurement, approval chains, and rollback — apply to AI systems just as they did to earlier technology waves. A key observation from a financial-services firm illustrated the problem: GitOps changes underwent six months of rigorous review, while an AI coding assistant like Copilot was treated as a harmless editor plugin, despite both affecting production code. The author argues that AI tools are effectively deployment paths in disguise, and governance frameworks have failed to recognize them as such. The central challenge is that AI has made code generation nearly free while review capacity remains unchanged, breaking an assumption that underpinned decades of software controls.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How a CDN Works Between Your Browser and Origin Server

A Content Delivery Network (CDN) is a distributed system of edge servers that delivers web content from locations geographically closer to users, reducing latency and origin server load. When a user makes a request, routing technologies like DNS-based routing and Anycast direct traffic to the nearest edge location, which checks if it can serve the content from its local cache. A cache hit means the resource is served directly from the edge without contacting the origin, while a cache miss triggers a fresh fetch from the origin server, which may then be stored for future requests. Cache duration is governed by Time to Live (TTL) settings, which vary based on how frequently content changes, and CDNs also offer purge mechanisms for immediate cache invalidation. Beyond caching, modern CDNs can also optimize the network path for dynamic or uncacheable content such as API responses, authenticated pages, and personalized data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

UchenML Lets Developers Compile Neural Networks Directly Into C++ Binaries

UchenML is a C++20 machine learning framework that embeds trained neural network models as compile-time constants directly inside C++ binaries, eliminating the need for separate model loaders or runtime file parsing. The framework represents model architecture as composable layer values, allowing parameter counts and shapes to be verified at compile time via static assertions. Weights are stored as flat float arrays and can be memory-mapped or packed in fp16 format, as demonstrated in a live browser demo running a model with over 2.7 million parameters. Training is supported within the same framework using immutable state updates and optimizers such as SGD and Adam, with the final output being a plain float array ready for deployment. Built with Bazel and tested across MSVC, GCC, and Clang, UchenML prioritizes portability and integration ease over Python-based alternatives.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Team Used Postgres Advisory Locks to Safely Reset Monthly Usage Quotas

A development team building a subscription-based app encountered quota reset failures for yearly subscribers and free-tier users, since both groups never trigger monthly payment events. To fix this, they built a Spring scheduler that runs at 00:05 UTC on the first of each month, decoupling quota resets from billing cycles entirely. The solution uses Postgres's pg_try_advisory_xact_lock to ensure only one application instance executes the reset job, even in multi-instance deployments. The non-blocking 'try' variant means competing instances exit immediately rather than queuing up, while the transaction-scoped lock auto-releases if the process crashes. The five-minute cron offset was deliberately chosen to avoid the load spike caused by multiple infrastructure jobs firing at exactly midnight.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Docker's YOLO Mode and the Case for Permission-Level AI Agent Security

Docker this week launched a feature called YOLO mode within its Sandboxes product, giving AI coding agents like Claude Code and GitHub Copilot CLI isolated microVMs with outbound firewalls so they can run unattended without human oversight. Unlike standard containers, each session uses a dedicated microVM with its own kernel running on a hypervisor, providing stronger isolation for agents that install packages and execute arbitrary commands. A senior software engineer at BS23 in Dhaka, building production AI agents with Spring Boot and Spring AI, argues that a microVM cage suits coding agents but not conversational e-commerce assistants with defined tool sets. During adversarial testing, the engineer discovered that a product description embedded with fake user instructions caused the agent to follow those instructions instead of answering the customer's question — an indirect prompt injection attack originating from the agent's own catalog. This highlighted three distinct attack channels for tool-equipped agents: direct user injection, indirect injection via tool outputs, and privilege abuse through tool side effects, each requiring its own targeted defense rather than process-level sandboxing.

0 comments Read more at DEV Community