AI can detect vulnerabilities, but who governs risk?

This post introduces the concept of governing AI-generated code and agentic workflows within the DevSecOps lifecycle. It argues that while AI can detect vulnerabilities, human-defined governance, context, and continuous assurance are crucial for managing risk and ensuring trustworthiness at scale. It contrasts LLMs' isolated code evaluation with platforms that provide broader context, emphasizing that risk decisions are contextual and dynamic. The post positions GitLab as an orchestration layer for end-to-end software lifecycle governance, enabling enforcement, visibility, and auditability for AI-assisted development.