Agents discover, code decides
This month I stopped doing security reviews by hand and built a system to run them. The design principle is simple. AI agents do the discovery and drafting. Deterministic code does the deciding. Between every stage sits a gate that fails closed, so an agent that produces nothing useful produces nothing at all, rather than something plausible.
Every finding is a claim
Discovery draws on several sources at once: automated scanning, live probing of a running instance, prior human review, and a model reading source directly for the logic and authorization flaws that pattern-based tools never catch. Each source feeds the same pipeline, and each finding is treated as a claim, not a fact.
Every claim then meets a second model whose only job is to disprove it. This was the most important lesson of the build. When the verifier worked from summaries, most findings survived. When it worked from the real code, only the ones that mattered did, and those came back sharper. Agents need evidence, not opinions.
Fixes that prove themselves
Remediation is gated even more tightly. Every proposed fix is isolated, must prove itself against a regression test, is re-probed live, and is measured against a known baseline so only genuinely new breakage blocks it. A human approves every change before it lands. The system has already refused fixes that would have broken legitimate access. It was right to.
Blast radius enforced in code
Blast radius is enforced in code, not in a policy document. The system refuses targets it has not been explicitly permitted to touch, and anything aggressive runs inside a sealed environment.
Building this cost more than one audit. It is also the only reason the next one will cost less.