About

From Principles to Enforcement: How Engineering Values Become Running Policy

Most organizations have a set of engineering principles – stated values that describe how software should be built. Things like “fail early and loudly,” “no undocumented dependencies,” “security is everyone’s responsibility.” These principles typically live in documentation, onboarding guides, and the institutional knowledge of experienced engineers. What they rarely do is run. Ethosure’s enforcement core is built around one central insight: engineering principles should not just be stated, they should be executable. This article traces Read more

security, guard, officer, uniform, airport, checkpoint, metal detector, scanner, turnstile, gate, access, safety check, protection, monitoring, cartoon, station, entry, access code, security service, access control

The Agent Proxy: A Checkpoint on Every Request, Response, and Tool Call

Git hooks and agent hooks catch problems at commit time and during active tool calls. But a complete governance picture for AI agents also needs visibility into the traffic flowing between the agent and the AI provider – the prompts being sent, the responses coming back, the tool calls being requested. That is the problem the Agent Proxy is designed to address. The Agent Proxy is a planned runtime boundary in Ethosure, currently in early Read more

code, software, development, git, branch, coding, version, isometric, git, git, git, git, git

Git Hooks and the Safe Path: Catching Bad Changes Before They Land

Version control is the foundation of every software project. It is where code goes from “written” to “official.” For organizations deploying AI coding agents, it is also one of the most critical enforcement points – because a commit that lands in the main branch is, in many senses, a fact. Undoing it requires effort, explanation, and often an incident report. Git hooks are the mechanism for enforcing policy at commit time, and Ethosure’s coding-ethos engine Read more

Runtime Sandboxing: Putting a Leash on an Approved Action

You have evaluated an AI agent’s proposed action against your policies, and the answer came back: ALLOW. The action is permitted. Now what? In a naïve governance system, “allowed” means the action runs without further constraint. But in any real-world deployment, this creates a problem: the system’s behavior after approval can still cause harm. A permitted linter tool might be compromised. A permitted command might consume all available memory. A permitted process might open a Read more

What is SARIF? The Common Language for “What the Checks Found”

Every security and quality tool has its own way of reporting what it found. One tool produces a JSON file. Another produces XML. A third produces a CSV. A fourth just prints to the terminal. The result, in most organizations, is a Tower of Babel problem: plenty of findings, no easy way to combine them, compare them over time, or feed them into the same dashboard. SARIF was created to solve this problem. Understanding what Read more

The Evidence Ledger: Tamper-Evident Proof an Auditor Will Accept

“Show me the evidence.” It is the most important question in any compliance review, and for AI-governed systems, it is the question that separates organizations that can demonstrate control from those that cannot. Ethosure’s answer to this question is the evidence ledger – a structured, tamper-evident record of every action an AI agent attempted and every decision the governance system made. What the evidence ledger is The evidence ledger is the continuous output of Ethosure’s Read more

confused, decision, man, doubt, anxiety, unsure, correct, wrong, question, decide, right, thinking, choice, making, negative, uncertain, opinion, trouble, answer, mark, option, problem, choose, solution, cartoon, confused, confused, decision, doubt, doubt, correct, wrong, wrong, wrong, wrong, wrong, question, question, question, decide, thinking, thinking, thinking, thinking, choice, opinion, answer, problem, problem

Allow, Transform, Escalate, Block: The Four Things That Can Happen to an Agent Action

When an AI coding agent proposes an action – running a command, editing a file, staging a commit – the governance layer in Ethosure must produce a response. That response is always one of exactly four options. Not “maybe” or “it depends.” Four options, each with a precise meaning, each producing a specific outcome for the agent and a specific record in the evidence log. This simplicity is intentional. A governance system with too many Read more

Fail-Closed by Default: Why “Block When Unsure” Is the Safe Choice

There is a classic security engineering question that reveals a lot about a system’s design philosophy: what does it do when something unexpected happens? When a system encounters ambiguity – a request it cannot fully parse, a condition it was not designed to handle, an edge case that falls between the rules – does it allow the action or block it? Systems that allow when unsure are called fail-open. Systems that block when unsure are Read more

Deterministic vs. Probabilistic: Why “The Same Answer Every Time” Matters

Imagine two versions of a fire suppression system. The first version, when it detects heat above a threshold, activates the sprinklers – every time, without exception. The second version analyzes the heat pattern, consults a learned model, and usually activates the sprinklers – but sometimes decides it was probably just someone cooking, so it waits. Which system would you trust with your building? This is the difference between deterministic and probabilistic decision-making, and it is Read more