About

Local-First and Sovereign-Ready: Why No Hosted Dependency Matters

Ask a financial institution’s chief information security officer whether they are comfortable routing AI agent governance decisions through a cloud service operated by a third party, and the answer will usually be no – or at minimum, a long conversation about data residency, vendor risk, and regulatory compliance. Ask the same question about a defense contractor, a healthcare organization, or a government agency, and the conversation gets longer still. Ethosure and its open-source coding-ethos engine Read more

Code Intelligence Memory: How the System Learns from Past Mistakes (and Saves Tokens)

An AI coding agent that encounters a policy violation for the first time might need several attempts to understand and fix it. An AI coding agent that has seen the same violation three times before should not need to rediscover the solution. More broadly, an organization running AI agents across dozens of sessions should not be paying for agents to repeatedly re-read the same files, re-run the same failed commands, or re-generate the same remediation Read more

data, sorting, classification, report, collection, decision, analysis, support, database, system, technology, business, big data, search, monitoring, separated, relevant, information, computer, cartoon, internet, science, process, service, data, database, database, database, big data, big data, big data, big data, big data

One Source of Truth: How Scattered Rules Compile into a Single Policy Bundle

Governance problems in software organizations often share a root cause: rules defined in one place are enforced differently in another, not enforced at all in a third, and unknown to a fourth. A security policy lives in a Confluence page; the Git hook that supposedly enforces it was written two years ago and has not been updated since; the CI pipeline has a slightly different interpretation; the AI agent has never heard of any of Read more

From Principles to Enforcement: How Engineering Values Become Running Policy

Most organizations have a set of engineering principles – stated values that describe how software should be built. Things like “fail early and loudly,” “no undocumented dependencies,” “security is everyone’s responsibility.” These principles typically live in documentation, onboarding guides, and the institutional knowledge of experienced engineers. What they rarely do is run. Ethosure’s enforcement core is built around one central insight: engineering principles should not just be stated, they should be executable. This article traces Read more

security, guard, officer, uniform, airport, checkpoint, metal detector, scanner, turnstile, gate, access, safety check, protection, monitoring, cartoon, station, entry, access code, security service, access control

The Agent Proxy: A Checkpoint on Every Request, Response, and Tool Call

Git hooks and agent hooks catch problems at commit time and during active tool calls. But a complete governance picture for AI agents also needs visibility into the traffic flowing between the agent and the AI provider – the prompts being sent, the responses coming back, the tool calls being requested. That is the problem the Agent Proxy is designed to address. The Agent Proxy is a planned runtime boundary in Ethosure, currently in early Read more

code, software, development, git, branch, coding, version, isometric, git, git, git, git, git

Git Hooks and the Safe Path: Catching Bad Changes Before They Land

Version control is the foundation of every software project. It is where code goes from “written” to “official.” For organizations deploying AI coding agents, it is also one of the most critical enforcement points – because a commit that lands in the main branch is, in many senses, a fact. Undoing it requires effort, explanation, and often an incident report. Git hooks are the mechanism for enforcing policy at commit time, and Ethosure’s coding-ethos engine Read more

Runtime Sandboxing: Putting a Leash on an Approved Action

You have evaluated an AI agent’s proposed action against your policies, and the answer came back: ALLOW. The action is permitted. Now what? In a naïve governance system, “allowed” means the action runs without further constraint. But in any real-world deployment, this creates a problem: the system’s behavior after approval can still cause harm. A permitted linter tool might be compromised. A permitted command might consume all available memory. A permitted process might open a Read more

What is SARIF? The Common Language for “What the Checks Found”

Every security and quality tool has its own way of reporting what it found. One tool produces a JSON file. Another produces XML. A third produces a CSV. A fourth just prints to the terminal. The result, in most organizations, is a Tower of Babel problem: plenty of findings, no easy way to combine them, compare them over time, or feed them into the same dashboard. SARIF was created to solve this problem. Understanding what Read more

The Evidence Ledger: Tamper-Evident Proof an Auditor Will Accept

“Show me the evidence.” It is the most important question in any compliance review, and for AI-governed systems, it is the question that separates organizations that can demonstrate control from those that cannot. Ethosure’s answer to this question is the evidence ledger – a structured, tamper-evident record of every action an AI agent attempted and every decision the governance system made. What the evidence ledger is The evidence ledger is the continuous output of Ethosure’s Read more

Subscribe to Ethosure's Newsletter to get monthly updates on AI Governance

We don’t spam! Read our privacy policy for more info.