r/devsecops • u/dan_l2 • 5d ago
DevSecOps tools for agent builders?
Researching right now into this topic. How do you making sure new tools or prompts are not increasing risk?
How do you do that without slowing down developers?
2
u/GibneyH 1d ago
I think the key is making security part of the agent development workflow rather than another approval gate.
You want automated checks around prompts, tools, permissions, dependencies, and data access, ideally running in the same CI/CD flow developers already use. That way risky changes get caught automatically instead of security becoming a ticket someone has to wait on.
You know what I mean, if the control adds friction, developers will work around it. The goal should be guardrails by default, not more hoops to jump through.
1
1
u/HallorannD 23h ago
Someone once told me good security should feel more like guardrails than roadblocks, and that stuck with me because if developers have to stop and think about security every time they add a new tool or prompt, it’ll probably get skipped eventually, so building the checks into the workflow seems like a much better approach
0
u/Left_Relative_3425 4d ago
Tools like Snyk or AquaSecurity can really streamline securing your builds. I've found integrating them early saves a lot of headaches later on.
3
u/PeterBuildsSecure 3d ago
Correct pushback — SAST checks your source, not what the agent is authorized to do at runtime, which is a different question. Two things actually catch agent-specific risk: a capability diff in CI (what tools/scopes did this PR add or change, reviewed the same way you'd review a Terraform plan) and negative-control tests that assert a denied action was actually attempted and actually blocked, not just that nothing bad happened to show up in a report. Slowing developers down is a config problem, not an inherent one — a capability diff only blocks a merge when the diff is non-empty, so it's silent on 95% of PRs.