3 ways dev teams use AI to improve software governance

The software governance problem

Governance usually starts with broad requirements. For example, a service should be reliable, applications shouldn't have known vulnerabilities and Kubernetes workloads should follow company security policies.

It's challenging to enforce these rules all the time. Modern apps have thousands of dependencies, run on many clusters and change often. Reviews can check whether requirements were met at a given point, but they can't keep up with every update or new vulnerability.

Nobl9, Anchore and Nirmata each turn goals into technical controls in their own way. Nobl9 uses measurable SLOs for reliability. Anchore builds a detailed list of software components with SBOMs. Nirmata turns infrastructure needs into policies that can be tested and enforced in Kubernetes. Let's look at each approach in detail.

Nobl9: Connecting SLOs with user experience

Nobl9 uses SLOs and error budgets to manage governance. An SLO sets the expected reliability for a service over time. The error budget shows how much failure is acceptable.

The challenge is picking the right indicator and target, one that matches what users experience. Occasionally, a team might meet an SLO that measures the wrong thing or set a target that the service has never reached.

Singer describes AI as useful across the reliability lifecycle, beginning with SLO creation. "AI does a great job at bringing in all the context -- code, user feedback, incidents in order to ensure we're creating great SLOs that truly reflect the user experience," said Singer. "At Nobl9, we've developed specialized AI to help manage gathering this context so teams are creating SLOs that match reality."

Nobl9 includes these features in Nobl9 Assist. Code, incident records and user feedback help set up SLOs. AI also helps teams look into what's happening when an SLO triggers an alert or uses up its error budget.

SLOs can change as the product, system or customer behavior shifts. Singer pointed out that AI can spot these changes, but only if people give it good information to work with.

"When humans do a good job building incident retrospectives, AI can help synthesize that and understand if SLOs have drifted," said Singer.

Looking at past performance is another way to check targets. If AI suggests a 99.99% goal for a service that's never reached, the team can compare this with real data before making a decision. The system can warn if a target would put the service out of compliance right away.

AI can help teams gather evidence, review current targets and notice when the numbers don't match what's really happening.

Anchore: Giving AI a record of software components

Reliability is only one part of the picture; teams also need a trustworthy record of the components and dependencies that make up the software they ship.

An SBOM offers a machine-readable inventory of versions, licenses, packages and files. Anchore Enterprise V6 enables SBOM data from containers, source repositories, file systems, virtual machines and outside tools to be standardized and aggregated into a single application view.

Alex Rybak of Anchore described their new Unified Asset Model, which deduplicates packages and vulnerabilities across assets. Teams can see one finding, understand where it appears and prioritize remedial action using signals such as severity, exploitability, known exploitation and fix availability, rather than reviewing the same issue multiple times.

Because an SBOM remains largely unchanged while vulnerability data continues to evolve, Anchore can continuously reassess software without rescanning the underlying artifact. Rybak described this as a way to reduce the "security tax" created by duplicate findings and disconnected security tools.

AI builds on that structured record rather than replacing it. Anchore is developing agent-based workflows through MCP and AI-assisted Package Insights to help teams query findings, prioritize risk, and assess factors such as package maintenance and project health.

The result is a clear division of labor: Anchore provides the trusted software inventory and security evidence, while AI helps teams interpret and act on it. 

Knowing what is in the software is essential, but teams also need a way to ensure that the infrastructure it runs on adheres to the rules.

Nirmata: Turning plain-language requirements into policy

Nirmata focuses on governance for Kubernetes and cloud-native systems. With Kyverno -- the popular open source project created by Nirmata -- teams write rules as Kubernetes resources to check, change or create configurations. Nirmata manages policies and reporting across clusters, while Kyverno enforces the rules.

Bugwadia explained why Kubernetes provides a suitable setting for this work:

"AI thrives on structured context and deterministic feedback loops. Because Kubernetes policies rely on a highly defined API schema that is easy to test and validate, translating natural language into reliable policy code is well within reach," he said.

The API schema limits what the model can create, and testing checks if the policy works as expected. Generating the policy is just the first step.

"We don't just generate policies and hope for the best - we equip AI agents with real-time test and validation tools. That creates a self-correcting feedback loop where the system tests, learns, and self-corrects the policy before it ever hits production," Bugwadia said.

A policy that's written correctly might still block the wrong workload or miss a risky setup. Testing lets the agent fix these issues before the policy goes live.

Bugwadia also separated the job of understanding context from the strict job of enforcing rules that can't be changed:

"Autonomous AI agents move at speeds that break static governance. A deterministic policy enforcement layer remains critical for non-negotiable rules, but modern governance now requires an AI-powered semantic layer to understand context, assess risk, and respond at machine speed," Bugwadia said.

The model can read a request and suggest a policy, but the policy engine still checks whether a resource complies with the organization's approved rules.

Three complementary layers of governance

Nobl9, Anchore and Nirmata each handle a different part of software governance. Nobl9 checks if a service meets its reliability goals. Anchore tracks what's in the service and looks at supply chain risks. Nirmata manages how infrastructure and workloads are set up in Kubernetes.

Each control does something different. A service might meet its SLO but still have a risky dependency. A clean SBOM doesn't show if a workload breaks a cluster policy. A valid Kubernetes setup doesn't guarantee users get good service.

AI is most helpful when it uses something that can be checked and reviewed. SLOs set reliability goals, SBOMs list what's in the software and policy as code gives rules for infrastructure.

Twain Taylor is a technical writer, musician and runner. Having started his career at Google in its early days, today, Twain is an accomplished tech influencer. He works closely with startups and journals in the cloud-native space.