Blog
Governance, pipeline design, and building verifiable agent automation.
Modulo vs Qodo: review governance and delivery governance are different things
Qodo governs the code a change contains, Modulo governs the agents and the delivery pipeline that produced it, and conflating the two leads buyers to evaluate each product against a job it never claimed.
Platform-generated events vs offline-verifiable evidence
GitLab announced a governed software factory with a record of every change, generated by GitLab. What a record the platform generates cannot prove, what offline-verifiable evidence requires instead, and why OWASP's Q3 recommendations depend on it.
What the OWASP Q3 2026 agent roundup means if you've put agents in your delivery pipeline
OWASP's Q3 2026 roundup lists nine agent security incidents, from evaluation agents that left their sandbox to an MCP server that rewrote its own tool metadata. Each one maps to a control a governed pipeline already runs.
GitHub put Copilot in a sandbox. Who governs what it ships afterwards?
Local sandboxing for Copilot went generally available on 7 October 2026. It bounds what the agent can touch while it runs. Containment and governance of the deliverable are different layers, and October improved one of them.
Agent governance as a dimmer switch - what Gartner's 2026 research asks for
Gartner's 2026 research on AI agent governance says binary controls cause agent failure, and calls for deterministic policy outside the model, scoped agent access with clear ownership, and controls that tighten or loosen with risk. Each recommendation maps to a mechanism in Modulo.
I'm in a regulated industry - how can I remain compliant and still have autonomous agent delivery?
Regulated teams hear "autonomous agent delivery" and assume it means skipping the controls their auditor already tests for. It doesn't - SOC 2, HIPAA, SR 11-7, and the NAIC's AI bulletin all ask for evidence, not headcount, and banks including Goldman Sachs, Monzo, and Sony Bank are already proving it.
Grow a forest, not a tree: how Modulo is built for the engineer one layer up
Individual engineers are faster than they were two years ago, but the surrounding delivery system has stayed the same size. Modulo's architecture treats that mismatch as a design problem and gives engineers a layer to govern from.
Feature Spotlight: How A/B testing finds the best agent configuration
Variants let you run the same pipeline with different prompts, models, or schemas side by side, so you can measure which configuration produces better output.
Feature Spotlight: How triggers start your pipelines on demand or on a schedule
Triggers start pipeline runs from external events, schedules, or manual calls, so your agents run at the right time without anyone pressing a button.
Feature Spotlight: How secrets management keeps your credentials out of agent state
Secrets are encrypted at rest with Fernet, decrypted once at run-start into a transient context, and never written to agent state, logs, or checkpoints.