AI writes your code now. Who answers for it?
Agents are opening pull requests inside your org this week. Real changes, headed for production. Ask what wrote one of them. Ask what it was allowed to touch, or what was actually checked before it merged. Then count how many people can answer. Human review was never designed for this volume — and in most orgs it’s the only control that actually reads the change. Everything else pattern-matches.
The problem
Start with the flow of the work. That’s where the answer should be.
An idea becomes a merged change in an afternoon. Somewhere in
between, a spec got interpreted, a plan got improvised, and code
landed on main. Ask which approval covers that change
and you’ll get a ticket number. Ask whether the code that
merged is the code that was approved, and the record goes
quiet.
Your company won’t let anyone expense a $40,000 server without an approval trail. A change to production is bigger than that. You’ll get the approval. You won’t get proof of what it covers.
Beneath it, three surfaces where trust breaks down
The pull request
The last moment anyone can say no. Today it’s a wall of green checks. They don’t say what actually ran, under whose policy, or which findings came from a tool and which from a model. Green is easy to collect and hard to trust.
The developer’s device
Where the agents actually work. Your EDR sees a process tree behaving like a developer. What the agent read, what it decided, what it changed and why — the only record of that is the one it wrote about itself. That’s not evidence. That’s a diary.
The agent
It holds credentials, reaches internal services, calls servers nobody reviewed. Your logs show a service account behaving normally. The only account of what it actually touched is the one it gives about itself. That proves nothing.
The default answer isn’t working
The industry’s reflex is speed: prompt the software into existence, then burn expensive model tokens patching whatever comes out. AppSec spent twenty-five years arguing against patch-and-pray. It doesn’t get safer because the patches got faster.
The author doesn’t approve the work.
It’s a rule older than software itself: the person who makes the change doesn’t approve it. Almost nothing enforces that rule for the machines already writing a third of your code — and, at the companies that build them, most of it. Everything we’re building starts there.
We believe the rule still holds when a model writes the code. We believe the evidence should come from somewhere the author can’t reach. We believe you shouldn’t have to slow down to get either.
We’re working on this quietly.
HapDo is in a private design-partner phase — a few seats for security teams willing to run it on their real repositories, audit mode first. We’re not publishing what we’re building yet. We’ll say this much: we run it on ourselves. Since late August, every pull request in HapDo’s own repositories gets a recorded verdict from the gate — even when the honest verdict is “no scan ran.” Nothing blocks yet.
If AI agents are writing code in your org and you want a say in what merges, we’d like to talk.
Rather just talk? Book 30 minutes — there’s nothing to buy. Opens Calendly on this page.
Latest research
The Agent’s Permissions Are the Security Boundary
An agent’s model is only one part of its risk. Identity, credentials, tools, network access, workspace, and execution policy define what it can do.