In recent weeks, something interesting has happened.
I wrote an article explaining why prompts aren't enough.
Then I addressed the issue of repository governance.
The ensuing discussions expanded on this idea.
I realized that GEF solved a significant problem…
…but only part of it.
When I started developing Guardian Engineering Framework, my goal was simple:
To embed engineering practices directly into the repository, taking them out of the prompts.
Instead of telling the AI:
write tests
follow the GitHub feed
document the architecture
the repository would already contain these requirements.
This still seems like the right direction to me.
But repository governance isn't the whole story.
Imagine an AI agent that could modify:
CI workflows
Branch protection
Code ownership
Repository rules
Deployment policies
At this point, governance becomes self-modifying.
The repository no longer dictates engineering practices.
The agent defines what engineering means.
That's a whole different issue.
This discussion led me to consider technical governance as a multi-layered system of trust.
AI Agent
↓
Repository Governance
CI
Hooks
ADR
Documentation
AI Rules
↓
Platform Governance
Branch Protection
Rule Sets
Required Reviews
Secrets
↓
Identity Governance
Permissions
OIDC
IAM
Administrator Rights
Auditing
Each layer protects the layer below it.
More importantly…
Each layer must be harder to modify than the one it protects.
Otherwise, the boundary of trust disappears.
This has also changed my view of GEF.
Today, GEF focuses on repository governance.
This is a deliberate choice.
It allows each project to benefit from a solid technical foundation from the very first commit.
But I no longer see repository governance as an end in itself.
I see it as the foundation.
The interesting questions that now arise are:
How do we continuously verify technical policies?
How do we measure governance drift? How do we audit policy changes?
How do we ensure that AI cannot, without its knowledge, circumvent its own constraints?
These questions are probably more important than rapid engineering.
They are also far more complex.
I don't believe that the future of AI-assisted software engineering lies solely in smarter agents.
I believe more in multi-level governance.
Because excellence in engineering has never been based on blindly trusting developers.
Perhaps AI should follow the same path.
Top comments (0)