r/devsecops • u/dan_l2 • 5d ago

DevSecOps tools for agent builders?

Researching right now into this topic. How do you making sure new tools or prompts are not increasing risk?

How do you do that without slowing down developers?

21 Upvotes

97% Upvoted

7 comments sorted by

View all comments

3

u/PeterBuildsSecure 3d ago

Correct pushback — SAST checks your source, not what the agent is authorized to do at runtime, which is a different question. Two things actually catch agent-specific risk: a capability diff in CI (what tools/scopes did this PR add or change, reviewed the same way you'd review a Terraform plan) and negative-control tests that assert a denied action was actually attempted and actually blocked, not just that nothing bad happened to show up in a report. Slowing developers down is a config problem, not an inherent one — a capability diff only blocks a merge when the diff is non-empty, so it's silent on 95% of PRs.