Grafana Dashboard-1
Grafana Dashboard-2
docker-compose container logs-1
docker-compose container logs-2
test-1
test-2
test-3
slack notification
cloudwatch project metrics-1
cloudwatch project metrics-2

ACE+RHG: Agentic Release Hardening Platform

Inspiration

Many software teams will use CI/CD pipelines to rapidly deliver their applications. The problem is ensuring that a successful build is actually secure and ready for production. Common issues including mis-configured Kubernetes manifests, insecure Dockerfiles, overly permissive GitHub Actions & infra policy breaches can all be deployed.

My aim was to create a platform to not just identify security issues but give a controlled release mechanism. The platform would understand why there was a policy breach, recommend a contextual fix, ensure it wouldn’t break the application and then make a decision to release safely.

This gave rise to ACE+RHG (AI Compliance Engine + Release Hardening Gate). ACE+RHG is an agentic platform designed to fit between the build and deployment stages in your CI/CD pipeline.

Development

The platform has been designed to have clear roles:

AI Compliance Engine (ACE) - Parse artifacts from your deployment (Kubernetes manifests, Terraform, Dockerfile & GitHub Actions). Convert them into a normalised format.

Open Policy Agent (OPA) - Run the artifacts through deterministic Rego policies to identify security and compliance issues.

Agentic Reasoning - Using NVIDIA Nemotron from Nebius Token Factory to understand what the issue is and recommend a contextual fix.

PatchEngine - Apply fixes using JSON Patch instead of the AI model making changes.

Compatibility Checker - Check if any of the changes recommended are compatible with the backend application.

Release Hardening Gate (RHG) - Analyse results and return whether to allow (ALLOW), apply patches (PATCHED) or block (BLOCK) back to the CI/CD pipeline.

A LangGraph based state machine was created with 3 specialised agents: Context, Remediation & Verification. Retries are supported and can be escalated to a human if there isn’t enough confidence or a way to safely resolve.

The platform also has CI/CD integration, pipeline status, PR feedback, mutation alerts and structured release events.

Challenges

One of the main challenges was using an AI model to reason but also ensuring that the AI model can never make a decision on whether a security policy is valid or invalid. By having a hard boundary between the OPA and Nemotron, we can ensure that only OPA can make decisions on policies. Nemotron will only reason.

Another challenge was ensuring that the AI wasn’t causing any breaks to the application. A fix may be applied to meet the security rule but it could cause issues like port mismatches or break an application dependency. To overcome this, a compatibility check was added to the backend.

Designing a robust agentic process was also challenging. We need to account for unknown recommendations, failed remediation, multiple attempts and escalation to humans. This was overcome by having clear states, confidence levels, a limit on retries and escalation.

Learning

Creating ACE+RHG has given me an understanding on how to design AI systems for engineering processes. I have learnt how to implement policy as code, OPA & Rego, CI/CD integrations, FastAPI services, parsing of artifacts, JSON patch, compatibility checking on the backend and agent orchestration with LangGraph.

I have also learnt about designing an architecture where AI is used to help make decisions but shouldn’t be making decisions on important security aspects. Policies should be deterministic, we should always verify and have auditability.