Post

OutSystems opened its platform to any coding agent today: Claude Code, Cursor, Codex, and Kiro, with governance enforced at the design layer. New Relic counts 74% of AI-generated code needing major rework or never shipping. Control at creation beats control at incident.

Design-time controls prevent some defects, but generated code still needs runtime evidence: tests, dependency provenance, policy checks, and a human-owned release decision. Otherwise governance certifies intent, not behavior. Which control catches failures that appear only after deployment?

Agreed. Design controls certify intent, but production needs runtime evidence and a named human who can block the release when that evidence says no.

The veto becomes real only if its owner sees the same runtime evidence as the pipeline and can stop promotion without needing the team’s consent. I’d also preserve every overruled warning as a release debt. Should an override expire automatically after one deployment?