Skip to content
LeavoryLeavory Docs

Governance in the age of AI

AI coding assistants changed how software gets written. A developer can generate in minutes what used to take a day: a new service, a Dockerfile, a pipeline, a set of dependencies. The code compiles, the tests pass, and it goes in.

What didn’t change is everything around the code. Someone still has to know what exists, what it depends on, who can change it, what it runs on in production and whether it carries a known flaw. When code is produced faster than it is reviewed, that knowledge is the first thing to get lost.

Leavory doesn’t slow AI down. It is the governance layer that keeps what AI produces visible and under control, from the repository to production, whoever (or whatever) wrote it.

What AI-generated code brings with it

Section titled “What AI-generated code brings with it”
What happens Why it matters What Leavory does
Dependencies added without review. Assistants suggest packages and versions from what they saw in training, sometimes outdated, sometimes vulnerable, sometimes packages nobody on the team has heard of Every new dependency is new attack surface, and outdated versions bring known CVEs back in The Workspace lists the packages of every repository, and the scans show which ones carry known vulnerabilities, with active exploitation first
Old base images copied into Dockerfiles. Examples learned by the model point to versions that are years old The image goes to production with every flaw published since then The Dockerfile tab scans each pipeline’s base image; Container Registry and Kubernetes show what is actually running
Secrets in the code. Generated examples often come with keys and passwords written inline A secret committed once stays in the history The Trivy scan reports exposed secrets in the code and the image, and the build card shows the count on every run
More repositories and pipelines, faster. Starting a new service is now a prompt away Nobody keeps the list up to date: owner, purpose, whether it’s still alive Automatic Azure DevOps discovery keeps the inventory of projects, repositories, branches and pipelines current, with no manual registration
Changes made in a hurry, with broad access. To unblock an agent or an automation, someone grants more permission than needed Access accumulates and nobody knows how many admins there are The Workspace shows the groups and members of each project, so too many admins stand out
“It passed the tests” becomes the only bar. Tests check behavior, not the age or severity of the flaws inside The Security Gate turns the company’s remediation policy into a rule on every build: a critical flaw past its deadline doesn’t reach the registry, no matter who wrote the code

Guardrails that don’t depend on who wrote the code

Section titled “Guardrails that don’t depend on who wrote the code”

Leavory doesn’t try to tell AI code apart from human code. It doesn’t need to: the controls apply to what reaches the pipeline and production, which is where the risk actually lands.

  • Visibility: the inventory, dependencies, images and access of the whole organization in one place.
  • Policy as a rule: remediation deadlines enforced by the pipeline, not by a document nobody reads.
  • Evidence: every finding dated and traceable, ready for an audit.
  • Read-only by design: Leavory reads Azure DevOps with minimum scopes and never changes code, pipelines or permissions.

AI on the right side

Section titled “AI on the right side”

Leavory also uses AI, with guardrails. Ask Leavory explains each finding and what to change first, on top of the data the Workspace has already collected and ranked. The AI helps fix; the decision and the policy stay with your team.

Where to go next

Section titled “Where to go next”