Agentic AI in DevOps

Deploy checks, failing pipelines and overnight alerts keep arriving after the laptop closes. Giving those jobs to an unattended agent takes shared context, visibility into its actions and boundaries it cannot ignore.

Andrey Devyatkin and Fernando Piviani unpack five building blocks for autonomous DevOps agents, covering live-data tools, tracing, existing harnesses, GitHub Actions and AWS runtimes, plus the sandbox and network controls that contain each run.

What you will learn:

• Which repetitive engineering jobs offer a clear first trigger
• How shared context and live reads serve different purposes
• What to record before an agent's first unattended run
• How triggers, run length and network placement shape runtime choices
• Why prompts cannot enforce credential and network boundaries

Maybe try B.O.R.I.S, our context layer for AI agents: https://www.getboris.ai

Episode page, show notes and links

A malicious package lands, and production scans only answer part of the question. Developer laptops may already hold it, while security teams spend hours finding out where they're exposed.

Andrey Devyatkin and Vladimir Samoylov join guest Mohit Bansal to explore Webflow's reduction of supply chain triage from hours to minutes, endpoint inventories, MCP credential risks, repository maturity gates and AWS account boundaries for AI agents.

What you will learn:

• How Webflow reduced supply chain triage from hours to minutes
• Why developer laptops belong in every malicious-package investigation
• Where MCP configs and agent transcripts leave credentials exposed
• How repository graduation gates focus remediation on production
• Why patching a base image still requires rebuilding and redeploying

Maybe try B.O.R.I.S, our context layer for AI agents: https://www.getboris.ai

Episode page, show notes and links

Agents can produce pull requests faster than teams can review them, even while Git stays fast. Hosting platforms face real scaling pressure, but most teams hit other limits first.

Andrey Devyatkin, Vladimir Samoylov and Fernando Piviani examine GitHub, GitLab and Cursor Origin's storage changes, Anthropic's Scion, file APIs that avoid unnecessary clones, and Entire's transcript checkpoints as a way to preserve intent without overlooking secrets and access controls.

What you will learn:

• Why Git hosting scale problems rarely require ordinary teams to migrate
• Which agent lookup jobs can use file APIs instead of clones
• Why short-lived credentials and separate transcript access boundaries matter
• How intent blocks help reviewers assess agent pull requests
• Why faster pushes do not eliminate coordination around a shared ref

Maybe try B.O.R.I.S, our context layer for AI agents: https://www.getboris.ai

Episode page, show notes and links

An agent can pass its evals and still disappoint customers. Production traces help only when someone turns real successes and corrected failures into tests worth trusting.

Andrey Devyatkin, Vladimir Samoylov and Fernando Piviani join Langfuse engineer Nikita Kabardin to discuss golden datasets, human review of evals, reliable pull request workflows, context for autonomous agents, and permission boundaries between customer data and public fixes.

What you will learn:

• Build a golden dataset from successful traces and corrected failures
• Recognize when an agent improves its scores by changing the grading
• Move pull request state transitions from prompts into deterministic code
• Understand why unattended agents need context beyond local Markdown files
• Keep private customer traces out of public development workflows

Maybe try B.O.R.I.S, our context layer for AI agents: https://www.getboris.ai

Episode page, show notes and links

An alert needs triage, a ticket needs a duplicate check, and a frontier LLM is generating answers for both. Decision models could make those routine checks cheaper, provided the thresholds and gates stay in code.

Andrey Devyatkin, Vladimir Samoylov and Fernando Gonçalves explore Jev, eight DevOps use cases, agent tool hooks, probability thresholds and local alternatives, including where classifiers fall short.

What you will learn:

• How decision models differ from LLMs with structured output
• Why uncertain probabilities belong in a review band around 0.5
• How pre-tool and post-tool hooks can filter expensive agent work
• Where alert triage, duplicate detection and GraphRAG could benefit
• Why classifier checks cannot replace permissions or deployment policy

Maybe try B.O.R.I.S, our context layer for AI agents: https://www.getboris.ai

Episode page, show notes and links

Claude Code can produce more code than an engineer can comfortably review. Trusting that output takes a repeatable workflow, protected learning time and checks that catch a solution to the wrong problem.

Andrey Devyatkin and Fernando Gonçalves join Kaido Koort to explore agentic engineering training, agent-led specs, validator sub-agents, session handoffs, verification versus validation, and what Claude certifications actually demonstrate.

What you will learn:

• How six Fridays progress from brownfield orientation to parallel agents
• How competing validator sub-agents expose trade-offs before implementation starts
• How transcript-based wrap-ups turn forgotten decisions into actionable issues
• Why verification and validation need separate gates for agent output
• How autonomy, parallelism and skill usage reveal different learning gaps

Maybe try B.O.R.I.S, our context layer for AI agents: https://www.getboris.ai

Episode page, show notes and links

Security alerts keep piling up while AI doom dominates the headlines. LLMs can help sort the queue, but useful triage depends on evidence, limited access and spending controls.

Andrey Devyatkin and Fernando Gonçalves discuss GuardDuty findings, live AWS policies, read-only permission traps and tool guards, explaining why assisted investigation and batch analysis should come before unattended agents.

What you will learn:

• How batching a week of alerts reveals rules worth tuning
• Why a CI/CD escalation finding needs live policy evidence
• Why ReadOnlyAccess can expose S3 objects and DynamoDB data
• How tool guards catch calls that IAM policies still allow
• Why separate invocation limits cannot cap spending across repeated triggers

Maybe try B.O.R.I.S, our context layer for AI agents: https://www.getboris.ai

Episode page, show notes and links

AI writes the code, yet engineers end the day buried in reviews and unsure what shipped.

Andrey Devyatkin, Vladimir Samoylov and Fernando Gonçalves talk with Julien Bisconti about reference implementations, review stopping rules, changing harnesses, token spend and the case for combining cloud expertise with industry knowledge.

What you will learn:

• How reusable reference projects make complex agent instructions concrete
• How a fixed review limit prevents endless rounds of findings
• Why local agent transcripts can become an overlooked store of credentials
• Why token spend alone cannot establish an engineer's productivity
• How business knowledge helps engineers challenge the wrong technical request

Maybe try B.O.R.I.S, our context layer for AI agents: https://www.getboris.ai

Episode page, show notes and links

Your agent can call every tool you give it and still not know which account a service runs in, what depends on it, or what changed last week. So every session starts with the same discovery work.

Andrey Devyatkin, Vladimir Samoylov and Fernando Gonçalves get into Grok 4.6 in Cursor, Anthropic's Claude Tag, cloud code review and AI-driven bug bounty noise, and why all four land on the same gap.

What you will learn:

• Why AWS Agent Toolkit gives an agent access, but not orientation
• What a CI reviewer misses when Terraform sits in another repo
• How live configuration turns bug bounty noise into provable findings
• Why infrastructure state belongs in a database, not a skills file
• What it costs to keep your context inside one vendor's memory

Maybe try B.O.R.I.S, our context layer for AI agents: https://www.getboris.ai

Episode page, show notes and links

AI adoption stalls when licenses and quotas replace trust, context, and verification. Fernando Gonçalves and Vladimir Samoylov explain how DevOps makes agentic coding safe to scale through checkable starter tasks, organization-specific context, independent tests, Terraform plans, and deterministic gates—while exposing why token metrics, AI-written tests, and advisory Markdown can create false confidence.

Maybe try B.O.R.I.S, our context layer for AI agents: https://www.getboris.ai

Episode page, show notes and links