Balancing Speed and Safety: A Control Framework for AI Coding Agents

Seed story: "Balancing speed and safety: A control framework for AI coding agents" (Amazon Web Services (AWS)) · search original Written from facts verified across 3 report(s) — original explainer, not a copy or translation. Sources at the end.

As AI coding agents like Kiro and Claude Code rapidly generate code and modify infrastructure across multiple repositories, the risk of unintended actions and supply chain vulnerabilities is escalating. Daniel Begimher and Danny Cortegaca propose a deterministic AppSec control framework that balances development velocity with safety by implementing strict author-time and build-time checks. This approach is critical for engineering teams aiming to mitigate prompt injection risks and prevent unsafe configurations from reaching production.

The Velocity-Safety Paradox in AI Coding Agents

AI coding agents like Kiro and Claude Code are dramatically accelerating development by generating features, tests, and refactors from natural-language prompts. However, this speed introduces a critical security paradox. A single agent can open dozens of pull requests across repositories in an afternoon, reaching far beyond the IDE to call APIs, query databases, and modify infrastructure via protocols like the Model Context Protocol (MCP).

This broad, automated execution creates significant risks, including inadvertent data disclosure, overly permissive configurations, and supply chain vulnerabilities. As prompt and context injection ranks as the top risk in the OWASP Top 10 for LLM Applications, developers must balance these efficiencies with robust safeguards. Without controls, unvetted changes can easily reach production, undermining the very stability these tools aim to enhance.

Deconstructing the Dual-Phase Control Framework

Daniel Begimher and Danny Cortegaca propose a dual-phase control framework to address the tension between rapid AI-assisted development and application security. Published on the AWS Security blog, their approach distinguishes between author-time controls, which prevent bad code generation at the source, and build-time controls, which block unsafe deployments before they reach production. This structure allows teams to maintain velocity while implementing necessary safeguards against the risks inherent in autonomous coding agents.

The framework is designed to be tool-agnostic and cloud-agnostic, though it references AWS services like Kiro and CodePipeline for illustration. By separating these phases, developers can integrate security checks directly into their existing workflows without forcing a complete overhaul of their CI/CD pipelines. This separation ensures that safety measures do not inadvertently slow down the iterative process of writing and refining code.

Key components of this strategy include:

Author-time validation: Intercepting issues before code is committed, such as detecting prompt injection or insecure configurations.
Build-time enforcement: Scanning artifacts and policies before deployment, ensuring only approved changes reach production environments.
Human-in-the-loop approvals: Requiring explicit consent for irreversible actions or changes that affect infrastructure.

This model helps developers manage the scale of AI-generated pull requests, which can number in the dozens per afternoon, by providing a structured gatekeeping mechanism that aligns with standard DevOps practices.

Mitigating Top LLM Risks: Injection and Data Leakage

Prompt and context injection stands as the top risk in the OWASP Top 10 for LLM Applications, a critical concern for developers leveraging AI coding agents. Because these agents can open dozens of pull requests and interact with external APIs or databases, a single malicious prompt can trigger cascading failures or security breaches. The proposed framework addresses this by strictly treating non-developer input as untrusted, ensuring that external data does not silently alter the agent’s behavior or intent.

To mitigate these specific threats, the control layer implements several key safeguards:

Input Sanitization: All non-developer inputs are isolated and validated before reaching the model’s context window.
Context Isolation: Agents are restricted from accessing sensitive environment variables or internal infrastructure unless explicitly authorized.
Behavioral Constraints: The system prevents the agent from executing commands that could modify production infrastructure without prior validation.

By enforcing these boundaries, teams can prevent inadvertent data disclosure and overly permissive configurations, ensuring that the agent’s actions remain predictable and secure even when faced with adversarial inputs.

Operationalizing Controls with Policy-as-Code and Human Approval

To bridge the gap between rapid generation and secure deployment, developers must implement concrete guardrails that enforce compliance without stifling velocity. The proposed framework suggests integrating policy-as-code scanning directly into the CI/CD pipeline, ensuring that every change is validated against security standards before it reaches production. This automated layer catches overly permissive configurations and supply chain risks early, shifting security left in the development lifecycle.

For high-impact actions, such as modifying infrastructure or executing irreversible commands, mandatory human approval gates are essential. Given that agents can open dozens of pull requests in an afternoon, manual review prevents uncontrolled changes from slipping through. Key implementation strategies include:

Treating all non-developer input as untrusted to mitigate prompt injection.
Requiring explicit human sign-off for any infrastructure modifications via protocols like MCP.
Embedding policy-as-code scanners to automatically reject non-compliant code.

By combining automated scanning with targeted human oversight, teams can safely leverage AI coding agents while maintaining strict control over their development environment.

Implementing the Framework: Tools, Protocols, and Next Steps

Integrating these controls requires bridging the gap between development workflows and security enforcement. While the framework is fundamentally tool-agnostic, practical implementation often leverages existing infrastructure like AWS Kiro and CodePipeline to automate validation. This approach allows teams to embed security checks directly into their CI/CD pipelines, ensuring that AI-generated code adheres to policy before it reaches production.

Key steps for operationalizing this framework include:

Treating all non-developer input, including AI prompts, as untrusted data to mitigate injection risks.
Enforcing human approval gates for any irreversible actions or significant infrastructure changes.
Implementing policy-as-code scanning to automatically detect overly permissive configurations or data leakage.

Crucially, developers must monitor Model Context Protocol (MCP) behaviors closely. Since agents can reach beyond the IDE to query databases or modify infrastructure, continuous visibility into these external calls is essential to prevent unintended side effects and maintain supply chain integrity.

FAQ

What is the proposed control framework for AI coding agents?

The framework organizes application security controls into author-time and build-time phases to manage risks associated with AI coding agents. It is designed to be tool-agnostic and cloud-agnostic, allowing it to be applied across different environments and platforms.

What are the primary security risks identified for AI coding agents?

Key risks include prompt and context injection, which is the top risk in the OWASP Top 10 for LLM Applications, as well as inadvertent data disclosure and supply chain vulnerabilities. Agents can also cause uncontrolled changes to reach production or modify infrastructure through protocols like MCP.

What recommended treatments help mitigate these AI coding risks?

Recommended treatments include treating non-developer input as untrusted and requiring human approval for irreversible actions. Additionally, the framework suggests using policy-as-code scanning to enforce security standards during the development process.