Notifications
Clear all
Topic starter
20/08/2026 5:51 pm
TL;DR: AI engineering is coalescing around loops, verification, and harnesses, with conference coverage showing AI-generated code at 27.6% of merged PRs and only about 48% explicitly reviewed, according to TruFoundry's analysis of AIEWF 2026. The governance gap is no longer model quality alone, but bounded execution, auditable traces, and enforced approval paths around AI systems.
NHIMG editorial — based on content published by TruFoundry: Loops, Harnesses, and 6,000 Engineers: What the World's Fair Confirmed and What Ships Today
By the numbers:
- AI-generated code accounted for 27.6% of merged PRs, up from under 1% fourteen months earlier.
- Only about 48% of that AI-generated code gets explicitly reviewed before merge.
- AIEWF 2026 brought together 6,000+ engineers, 300 speakers, and 29 tracks.
Questions worth separating out
Q: How should security teams govern AI loops that can take multiple actions without pausing?
A: Security teams should bound AI loops with explicit step ceilings, timeouts, and approval gates on sensitive actions.
Q: Why do AI agents complicate access governance more than ordinary automation?
A: AI agents complicate access governance because they can branch at runtime, wait on external services, and continue later with the same operational context.
Q: What do organisations get wrong when reviewing AI-generated work?
A: They often assume downstream human review will catch unsafe output before it matters.
Practitioner guidance
- Define hard stop conditions for AI loops Set explicit step ceilings, timeout rules, and budget thresholds for every delegated run so repeated execution cannot continue indefinitely.
- Move approval gates to the action boundary Require human approval before sensitive tool calls, code merges, data access, or external side effects.
- Make traces part of identity evidence Preserve per-step logs, credentials used, outputs created, and retry history so that AI actions can be reconstructed during audit or incident review.
What's in the full article
TruFoundry's full analysis covers the operational detail this post intentionally leaves for the source:
- The documented Agent Harness flow, including managed plan-act-observe execution and approval points.
- The gateway controls that broker credentials, enforce quotas, and preserve per-step traces.
- The conference coverage and source links behind the 27.6% and 48% figures, useful for deeper validation.
- The surrounding platform documentation for loops, governance controls, and runtime observability.
👉 Read TruFoundry's analysis of AI loops, verification, and harness governance →
AI gateway governance: are loops and verification keeping up?
Explore further
20/08/2026 6:30 pm
Loopcraft is now an identity governance problem, not just an engineering style. Once an AI system can chain actions across tools and sessions, the control question changes from whether access was granted to whether its authority was bounded in time. The old assumption was that identity behaves in discrete requests that humans can review later; that assumption breaks when the actor keeps deciding and acting before a reviewer ever sees the trail. Practitioners should treat looping behaviour as a governed identity pattern, not a developer preference.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Another 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
A question worth separating out:
Q: How should IT teams govern identity access when AI becomes part of the operating model?
A: IT teams should treat AI-enabled workflows like any other production access path: assign a named owner, define the business purpose, scope permissions tightly, and make revocation explicit. The important shift is governance, not tooling. If AI expands what IT can do, identity controls must expand with the same discipline.
👉 Read our full editorial: AI gateway governance now hinges on loops, verification, and harnesses
