Governance problems in software organizations often share a root cause: rules defined in one place are enforced differently in another, not enforced at all in a third, and unknown to a fourth. A security policy lives in a Confluence page; the Git hook that supposedly enforces it was written two Read more
Most organizations have a set of engineering principles – stated values that describe how software should be built. Things like “fail early and loudly,” “no undocumented dependencies,” “security is everyone’s responsibility.” These principles typically live in documentation, onboarding guides, and the institutional knowledge of experienced engineers. What they rarely do Read more
Imagine two versions of a fire suppression system. The first version, when it detects heat above a threshold, activates the sprinklers – every time, without exception. The second version analyzes the heat pattern, consults a learned model, and usually activates the sprinklers – but sometimes decides it was probably just Read more
Security engineers often talk about “defense in depth” – the idea that no single control should be the only thing standing between an attacker and damage. coding-ethos and Ethosure apply this principle through a clean architectural separation between two layers with different jobs: the control plane decides whether an action Read more
One of the most important words in AI governance right now is “deterministic.” It means: given the same input, the system produces the same output, every time, without exception. A coin flip is not deterministic. A weather forecast is not deterministic. A fire suppression system is – and that is Read more
Most organizations have no shortage of written rules. There are security policies, coding standards, compliance frameworks, architectural principles, and onboarding guides. The problem is that written rules are only as good as the people – or agents – reading them. When an AI coding agent writes a thousand lines of Read more
Every company deploying AI coding agents faces the same uncomfortable question: how do you know what the agent actually did, whether it followed your rules, and whether the evidence would hold up to a regulator’s scrutiny? Ethosure’s answer rests on an open-source project called coding-ethos, built and owned by one Read more
