AfterCode Guardian

The problem

Enterprise software changes rarely affect only the code being edited. A small change to an employee identifier can affect downstream payroll processing, finance headcount reconciliation, and learning account provisioning. These dependencies can be difficult to track in legacy enterprise environments.

The solution

AfterCode Guardian is a deterministic change-impact analysis prototype. It identifies downstream consumers of a proposed change, links findings to source-level evidence, suggests targeted validation tests, and produces a risk decision.

In the demo, a change from employee_id to worker_id affects three example consumers: payroll, finance headcount, and learning provisioning. The analysis identifies the dependencies and returns a BLOCK decision because the example includes high-risk consumers.

GitLab integration

GitLab CI/CD runs the validation and impact analysis. A decision artifact passes the risk result between pipeline jobs. The release-approval job denies the sample high-risk change unless the explicit exception variable is supplied.

The project also demonstrates GitLab Duo's native Code Review flow on a merge request. Duo provides advisory feedback, while AfterCode Guardian's deterministic risk decision remains the release gate.

Implementation and learning

I built a Python prototype, dependency manifest, evidence-backed impact reporting, unit tests, and an artifact-backed CI release gate. I also used GitLab Duo's review feedback to improve the demo documentation.

A key design principle is separating AI-assisted review from deterministic release policy: review feedback can improve a change, but it does not silently override the risk decision.

Current scope and future work

The prototype analyzes example Python source files and a manually maintained dependency manifest. It does not yet connect to a live Workday tenant or implement a custom GitLab Duo agent or flow. Future work includes automatically extracting dependencies from enterprise integration artifacts, expanding regression-test generation, and adding stronger approval controls for release exceptions.

Built With

• ai
• ci/cd
• devsecops
• gitlab
• gitlab-duo-agent-platform
• pytest
• python
• security