For engineering teams: compliance in your pipeline

Why bother

The controls auditors ask about (testing, logging, change management, human oversight) are things your pipeline already does. Sending the proof automatically means nobody has to collect screenshots later.

A simple setup

1. 1
   Create an AI owner API key for your pipeline and store it as a secret.
2. 2
   When a model or prompt changes, upload the evaluation and test reports as evidence on the right controls.
3. 3
   Run the red-team suite against staging for LLM features, and fail the build if attacks get through.
4. 4
   Before deploying, call the compliance gate for the system. It tells you whether the system is ready to ship and why not; fail the build if it isn't.
5. 5
   Use webhooks to post new findings and incidents to your team chat or ticket system.

Full examples are in the developer documentation.

Agents and tools

If you build agents, register their tools and MCP servers in Agents & assistants. Tools that move money or run code need a person in the loop or tight limits, a kill switch and action logging.