№ 01 ADVISORY RETAINER

Your agents are
ignoring rules
you wrote. You'd have
no way to know.

$15,000/month. Month to month, no minimum. We help your team build the machinery around AI-written code — patterns, worked examples, and a read on your gate design before you spend a sprint on it. Then a probe you run in your own CI reports, every month, on whether any of it held.

Book a discovery call → Take the 3-min scorecard →
Principal
Paul Duvall · LinkedIn ↗
Background
Former AWS Director, Office of Security Innovation · Co-founded Stelligent (sold stake 2017; co-led Mphasis sale 2018)
Authored
Continuous Integration book coverContinuous Integration · Addison-Wesley
Security for Agentic Engineering · Pearson
Shipping AI since
Early 2023
№ 02 THE PROBLEM

Tools bought, capability not built

The licenses are already bought. What almost never follows is a change in how code actually reaches production. Buying a tool is a purchase order; changing how a team ships is org change — and that second thing is the whole job.

Self-serve doesn't change teams

Courses and plugins teach individuals. They don't govern AI output, harden the pipeline, or change how a team delivers. That's an org-change problem.

Generalists staff it wrong

Big-4 engagements are junior-staffed and process-heavy, thin on current agentic-DevSecOps practice. The gap is one senior practitioner working with your team, not writing for them.

№ 03 WAYS TO WORK TOGETHER

Start where you are — not where the proposal says you should be.

Two ways in, priced on this page rather than on a call. Neither one needs repo write access, production credentials, or SSO.

№ 01 Free · 3 min

Readiness
scorecard

Fifteen questions → a readiness score across the three pillars, the patterns to apply, and a 30-day action plan. Emailed instantly.

Best when
You want a baseline first
Commitment
None

Take the scorecard →

№ 02 $15,000 / month

Advisory
retainer

Help building the harness — patterns, worked examples, and a read on your gate design before your team spends a sprint on it. Plus a monthly drift report from a probe you run in your own CI, so you can see whether any of it held.

Best when
Your team builds it and wants it checked
Commitment
Month to month, no minimum

How the retainer works →

№ 04 THE RETAINER · $15,000 / MONTH

Every gate your agents skipped last month — in writing.

Rules get bypassed under deadline. Hooks get disabled just for this one PR. Permissions widen, gates get skipped, and none of it surfaces anywhere — the harness you agreed on and the harness actually running drift apart quietly. So the retainer does two things: helps your team build the machinery, then measures whether it held.

№ 01 In your CI

harness-
probe

You run the container yourself, in your own pipeline. It emits metadata-only JSON: gate coverage, hook execution, permission scope, traceability. No repo write access, no production credentials, no SSO.

№ 02 Every month

The drift
report

Month one sets your baseline. Every month after says what moved against it, what regressed, and what to do about it in priority order. It arrives whether or not you booked the session, opened the channel, or thought about us at all.

Read a full sample report →

№ 03 Direct line

Working
sessions

A monthly session on what you're actually building — patterns to apply, worked examples from harnesses already running, and a read on your gate design before your team spends a sprint on it. Plus a private channel in between.

What the retainer is not: a review of your application code. The subject is everything around the code — the rules and hooks your agents work inside, the gates in CI, the permissions, the traceability. Your domain logic is your business; the machinery that decides what reaches production is ours. And nothing we hand you should reach production on our say-so: it clears your review and your gates like any other change.

№ 01 Good fit

This is
for you if

Agents are already writing code that reaches production — or soon will. Someone owns the rules, hooks and CI gates by name, and can act on a report when it lands. And you would rather be handed a number than be reassured — including in the months the number is worse.

№ 02 Not a fit

This isn't
for you if

You want your application code reviewed — that stays your team's job, deliberately. Or nobody owns your gates, in which case the report arrives every month with no one to act on it. Or you want it built for you: we advise and show worked examples, but your engineers do the building.

№ 05 WHAT YOU OWN

An agentic harness your team operates and maintains.

The harness is the engineered Claude Code environment your engineers work inside, built on the open Agentic Continuous Delivery ↗ operating model. It outlasts us because your team builds with it daily.

№ 01 Governance

Standards
& hooks

CLAUDE.md standards, plus .claude/ PreToolUse / PostToolUse hooks that enforce them automatically on every change.

№ 02 Context

Subagents, skills
& context

Reusable agents, skills, and slash commands — with MCP wiring that gives them your internal context.

№ 03 Security

Secure delivery
& ACD

OIDC identity, SAST / SCA / secret-scan gates on every change, versioned delivery-contract artifacts, and small-batch sessions.

№ 06 FOR THE CISO

Five failure modes your AppSec program doesn't cover yet.

Security appears in the headline of every AI-coding pitch and then disappears into a bullet. These are the specific things that go wrong when agents write code, and the specific gate that catches each one. Every control below is one your team owns and can audit — not a promise about our tooling.

Prompt injection through your own repo

A code comment, a README, an issue body, a dependency's docs — the moment an agent reads any of it, it is untrusted input. Instructions buried in content you already trust get executed with your engineer's permissions. The control: treat repo content as data, never as instruction — PreToolUse hooks that gate what an agent is allowed to act on, and a permission scope narrow enough that "helpfully" running a shell command isn't available in the first place.

Inherited credentials and blast radius per tool call

An agent runs as whoever launched it. Left alone, that means the full developer credential set — cloud, registry, CI, production read access — available to every action it decides to take. The control: scoped OIDC identity per session instead of long-lived keys, and an explicit allow-list evaluated per tool call, so the blast radius of any single action is bounded before it runs and logged after.

Supply chain, chosen by a model

Agents install packages, add MCP servers, and pull CI actions. Each one is new code running with your permissions, selected by something optimizing for task completion rather than for provenance. The control: SCA gates on every change, pinned action SHAs, and a human review step for any new MCP server or dependency — because an MCP server is an unreviewed integration with tool access, not a config line.

Secrets in context windows

A .env read "for context" is now in a transcript, a prompt cache, and possibly a vendor's logs. It will not show up in a code review, because it never reached the code. The control: secret-scan gates that fire pre-commit and pre-tool-use, deny-lists on file reads, and a rotation trigger for the times one lands anyway — because sometimes one will.

Traceability as audit evidence

When an auditor asks which agent made which change, under which rules, with which gates in force — "we think so" is not an answer, and neither is a git blame pointing at a human who pressed accept. The control: versioned delivery-contract artifacts, so every change ties back to the exact rule, hook, and gate versions that were active when it was made. Evidence you can hand over, not reconstruct.

Mapped to frameworks your auditors already accept. Controls are tracked against OWASP DSOMM for maturity and NIST SSDF for secure development practice; the agent-specific failure modes above are classified against MITRE ATLAS, which covers adversarial technique against AI systems — prompt injection included. Nothing here asks you to accept a new standard, and nothing here reaches production without clearing your existing review.

№ 07 HOW WE MEASURE

Team delivery outcomes, not agent output.

The goal is shipping faster and more safely by adopting agentic techniques — not generating more code. So success is measured the way you'd measure any high-performing team. No agent-vs-human comparisons, no lines-of-code vanity. Targets are agreed and baselined up front.

№ 01 Delivery

Ship faster,
safely

The DORA four keys: deployment frequency, lead time for changes, change failure rate, and failed-deployment recovery time.

№ 02 Security

Security
holds

OWASP DSOMM / NIST SSDF: mean time to remediate critical findings, critical vulns escaping to production, and security-gate coverage.

№ 03 Adoption

The practices
stick

What you keep: ACD guardrails in place, and teams operating the harness on their own.

№ 08 TRACK RECORD

Two decades of making CI/CD work — now applied to AI-generated code.

The patterns that took Continuous Integration from contrarian to standard practice now apply to AI-assisted engineering.

  1. 2007

    Wrote the book on Continuous Integration.

    Jolt Award-winning Continuous Integration: Improving Software Quality and Reducing Risk (Martin Fowler Signature Series) helped grow the discipline.

    Jolt Award WinnerMartin Fowler Signature Series
  2. 2008–2021

    Founded Stelligent. Zero to acquisition.

    Scaled from zero to nearly 100 enterprise customers and AWS Premier Partner status as founder and CTO. Sold his stake in 2017, then co-led the company's sale to Mphasis in 2018.

    100 Enterprise customersAWS Premier Partner

    Customers served: Sony Pictures · Verizon · Citi · 3M · Prudential · Macy's · Northwestern Mutual · Commonwealth Bank of Australia · National Cancer Institute · CollegeBoard, and many others.

  3. 2021–24

    AWS: Director, Office of Security Innovation.

    Led security engineering teams at AWS, building services and patterns that helped Fortune 500 customers operationalize DevSecOps across hundreds of engineering teams.

    AWS Engineering LeadershipAWS Hero 2016–2021
  4. 2025→

    Redacted Ventures.

    Founded Redacted Ventures to do for AI-native development what CI/CD did for software delivery: make the discipline repeatable, measurable, and teachable. Wrote Security for Agentic Engineering (Pearson) on the failure modes of agent-written code. Daily, hands-on AI coding practice since early 2023, visible in the open-source patterns we publish.

    850+ Stars across reposEarly 2023 Daily AI coding
№ 09 WRITING & OPEN SOURCE

The patterns are in the open — readable, forkable, and discussed in public.

Every pattern we install is public — free to read and build on. More writing at paulmduvall.com ↗.

PaulDuvall/ai-development-patterns★ 637

ai-development-
patterns

A working reference for AI-assisted engineering. Context files, rules, multi-agent orchestration, and testing patterns.

View repository →
PaulDuvall/claude-code★ 106

claude-code

Transforms Claude Code into a complete development platform with AI-powered commands that automate your software development workflow.

View repository →
PaulDuvall/centralized-rules★ 27

centralized-
rules

A single source-of-truth rules system for AI-assisted development. Version-controlled, reviewable, and enforceable across every tool your team already uses.

View repository →

So why pay for what you can read for free? You shouldn't, if reading is all you need — take the patterns and run. What the repos can't tell you is which of them your team quietly stopped following last quarter, which hook someone disabled to get a release out, or which gate has been failing open since a migration in March. That isn't in any repository, because it's a fact about your pipeline on a particular Tuesday. Reading the patterns is free. Knowing whether yours still hold is the part that needs measuring.

→ FROM PAUL
More from Paul at paulmduvall.com
Writing on AI-native engineering, DevSecOps, and what comes after continuous delivery.
paulmduvall.com ↗
№ 10 QUESTIONS

The two we get before every call.

Answered here so you don't have to book a call to find out whether this is a fit — or whether it isn't.

What does the retainer measure drift against?

Month one is the baseline month: harness-probe runs in your CI and the first report describes where you actually are, not where you moved. Every month after measures against that. Nothing to buy first, and nothing to finish building before the number means something — if the machinery is half-built, that's what month one tells you.

What access do you need to our systems?

No repo write access, no production credentials, no SSO. harness-probe runs inside your CI, under your credentials, and emits metadata-only JSON — gate coverage, hook execution, permission scope, traceability. Your source never leaves your perimeter, and nothing we hand you reaches production without clearing your review and your gates like any other change.

The monthly session and the Slack channel are screen share and client-chosen excerpts only. You decide what context we see.

№ 11 START A CONVERSATION

Tell us where your team is — we'll figure out the next step together.

Starting the retainer, or just stress-testing the idea before you bring it to your team? One call to confirm whether this is the right thing for you — including telling you if it isn't. Typical response within one business day.

Response time
< 1 business day
Retainer
$15,000/mo · no minimum
Time zones
US business hours