From Chef to Chief Architect: Navigating the Intersection of AI and Data Security | Harness Blog

Prefer to watch the video instead?

Managing a global army of 450+ developers, Devan has seen the "DevOps to DevSecOps to AI" evolution firsthand. Here are the core AI data security insights from his conversation on ShipTalk.

1. The Bedrock: Scaling to 450+ Developers

IBM’s internal "OnePipeline" isn't just a convenience; it’s a necessity. Built on Tekton (CI) and Argo CD, the platform has become the standard for both SaaS and on-prem deliveries.

• The "Speed vs. Value" Trade-off: During the migration from Travis CI to Tekton, build times initially jumped from 10 minutes to 30. However, the team realized this wasn't inefficiency—it was automated maturity. The extra time accounted for mandatory static, dynamic, and open source scanning.
• The Result: Audits for SOX, NIST, and ISO compliance changed from "scrambling for logs" to "pulling automated reports."

This transition highlights a growing industry trend: as code generation accelerates, the bottleneck shifts to delivery and security. This phenomenon, often called the AI Velocity Paradox, suggests that without downstream automation, upstream speed gains are often neutralized by manual security gates.

2. AI in the SDLC: "Bob" and the Rules of Engagement

IBM uses an internal AI coding agent called "Bob." But how do you ensure AI-generated code doesn't become technical debt?

"It’s not just about the code working; it’s about it being maintainable. If you don't provide context, the AI will build its own functions for JWT validation or encryption instead of using your existing, secure SDKs." — Devan Shah

To combat this, the team implements:

• Contextual Rules Files: Hard-coded guidelines that tell the AI which helper packages and security protocols to use.
• AI Code Reviews: Using LLMs to review PRs with specific guardrails, ensuring that "vibe coding" (quick POCs) is elevated to production-ready standards.

Quantifying the success of these initiatives is the next frontier. For organizations looking to move beyond "vibes" and toward hard data, the ebook Measuring the Impact of AI Development Tools offers a framework for tracking how these assistants actually affect cycle time and code quality.

3. AI Data Security: "Crown Jewels In, Crown Jewels Out"

We’ve all heard of "Garbage In, Garbage Out," but in the AI era, Devan warns of "Crown Jewels In, Crown Jewels Out." If you feed sensitive data or hard-coded secrets into an LLM training set, that model becomes a potential leak for attackers using sophisticated prompt injection.

The Rise of DSPM

Data Security Posture Management (DSPM) has emerged as a critical layer. It solves three major problems:

1. Shadow Data Discovery: Finding where PII lives in unstructured formats (PDFs, logs, S3 buckets).
2. Posture Verification: Identifying unencrypted buckets or public-facing databases.
3. Data Flow Mapping: Detecting GDPR violations.

For a deeper technical look at how infrastructure must be architected to protect customer data in this environment, the Harness Data Security Whitepaper provides an excellent breakdown of security and privacy-by-design principles.

4. Architecting for the "Agentic" Future

We are moving beyond simple chatbots to Agentic Workflows—where AI agents talk to other agents and API endpoints.

• The Risk: An agent with "Full Admin" permissions could accidentally delete an entire cloud account if it misinterprets a prompt.
• The Solution: Architecting for Just-In-Time (JIT) token provisioning and Least Privilege access. Agents should only have the permissions they need for the exact second they are performing a task.

5. The "No Jail" Architectural Principle

When asked how to balance speed with security, Devan's philosophy is simple: Identify the "Bare Minimum 15." You don't need a list of 300 compliance checks to start, but you do need 10 to 15 non-negotiables:

• Automated CI/CD security gates: Ensuring every piece of code—AI or human—passes the same rigorous checks.
• An inventory of every AI model used: To prevent "Shadow AI."
• Pre-approved weight and training data reviews: For off-the-shelf models.

Final Thoughts

Whether you are a startup or a global giant like IBM, the goal of software delivery remains the same: Ship fast, but stay out of legal trouble. By integrating AI data security guardrails and robust data protection directly into the pipeline, security stops being a "speed bump" and starts being a foundational feature.

Want to dive deeper? Connect with Devan Shah on LinkedIn to follow his latest work, and subscribe to the ShipTalk podcast for more insights on using AI for everything after code.