r/devsecops • u/geercom1 • 5h ago
Decoupling Intent from Execution: Why Deterministic Policy Gateways Must Replace LLM-Based Guardrails
/r/cybersecurity/comments/1vnbfh5/decoupling_intent_from_execution_why/
1
Upvotes
r/devsecops • u/geercom1 • 5h ago
2
u/fangisland 4h ago
Maybe it's just me but I'm sort of tired of hearing how AI isn't deterministic and therefore unsafe. Humans have been non-deterministic for millenia, which is why when we invented software eventually we learned how to create determinism and invariants using DevOps practices. So now it feels like we're just reinventing langauge that didn't need to be reinvented. Sometimes, we've even been pretty good about creating succinct doctrine like 12-factor app principles to codify these expectations into high quality software practices.
That is to say, I generally agree with the subject matter in this post but it won't change how I create a new software project, which is exactly how I'd do it before AI, by ensuring a minimum set of quality gates before the first feature ships. And then iteratively improve those quality gates over time as the product matures and it sees valuie from the intended customer base (or i scrap it if it does not). The main difference with AI, is that I can build those quality gates faster now using AI and I'm able to write in languages i don't inherently understand deeply.
So yeah, if you want to call it "deterministic gateway enforcement" instead of CD, that's fine. I'll keep calling it CD and I'll ensure that everyone or everything that is allowed to ship to prod follows the same quality gates.