Neural Inverse Govern / Developer governance
AI-written changes pass your review rules before they merge.
A merge gate for pull requests that AI coding tools write, control of CI/CD runs, and governance of the dependencies, tests, documentation, APIs and infrastructure code AI produces.
- Source control
- GitHub and GitLab, SaaS or self-managed
- Gate
- A required check on the head commit
- Attribution
- Claude Code, Copilot, Cursor, Codex, Devin and more
- Approvals
- Never by the requester
- Record
- Every gate decision audited
Overview
Govern receives signed webhooks from GitHub and GitLab, works out which AI tool wrote each pull request, evaluates your review rules and publishes the result on the head commit. Branch protection that requires the check then blocks the merge until the gate passes. Around it, CI/CD runs, new dependencies, AI-written tests and documentation, API specifications, refactorings and infrastructure code each have their own policy, and an approval is never given by the person who asked.
What it does
What developer governance covers.
Only what works today.
AI pull request rulesRules by repository pattern, for AI-authored changes or for every change: blocked tools, a minimum review score, a person other than the author after the AI, a cap on AI-written lines and DLP on the description. The most specific rule applies.
Review scores from registered sourcesA required score must come from a review source an administrator registered, for the current head commit. A member's own session cannot post one.
Signed webhooksGitHub, GitHub Enterprise Server, GitLab and GitLab self-managed deliver signed webhooks. A bad signature or an unknown connection is refused before the body is read, and a delivery cannot be replayed.
AI attributionBot authors, commit trailers, author emails, labels, description markers and branch prefixes identify Claude Code, Copilot, Cursor, Codex, Devin, Aider and others. Attribution stays once seen, even if a marker is removed.
Result on the commitThe gate publishes a Check Run through a GitHub App, or a commit status on GitHub or GitLab, so branch protection or merge checks can require it.
Source control governanceCommits, pull requests, changelogs, releases and versions are validated with secret and blocklist scanning, and push and pull request events are recorded from signed deliveries.
CI/CD controlRegister CI platforms with policies, hold pipeline runs for approval or rejection, scan runs with DLP and post commit statuses. Source control tokens are kept in the vault.
DevOps actionsAI-proposed deployments, rollbacks, environment changes and CI configuration are gated, with Dockerfile scans and remediation actions.
DependenciesOrganisation dependency policies, and requests for new dependencies that someone other than the requester approves or rejects.
TestsTest suites with coverage and mutation trends, assertion analysis, organisation thresholds and quality gates. AI-written tests are evaluated, with DLP on their test data.
DocumentationAI-written documentation is scanned for leaked sensitive data and for references to code that does not exist, under an organisation policy.
API specificationsA registry of API specifications with analysis for personal data and authentication, version comparison, and review that the author cannot approve.
RefactoringsRefactoring sessions with impact analysis, an architecture gate, staged rollout plans and rollback, approved by someone other than the requester.
Code search, environments and debuggingApproved code search tools with DLP on queries and results, named environments with rules for actions in each, and AI debugger sessions with sanitised output.
Infrastructure as codeIaC policies, analysis sessions with findings, an organisation cost budget with a cost gate, and a check for privilege escalation.
Database changesQueries analysed against database policies, migrations checked for safety, query cost tracked, and approved query templates.
How it works
How an AI-written pull request reaches the merge button.
- OpenAn AI coding tool, or a person using one, opens a pull request.
- ReceiveGitHub or GitLab sends a signed webhook; Govern verifies it before reading it.
- AttributeGovern identifies the tool that wrote the change from the strongest signal.
- EvaluateThe most specific rule is applied: tools, score, DLP and AI line count.
- ReviewA person other than the author approves the current head commit. A push after the approval needs a new one.
- PublishThe result is posted on the commit; branch protection blocks the merge until it passes.
Who uses it
Built for every role that answers for AI.
Engineering leadsWrite review rules for AI-authored changes and decide which repositories require the gate.
Platform and DevOps engineersConnect source control and CI platforms, and approve held runs and DevOps actions.
Security teamsRegister review sources, set DLP on descriptions and runs, and approve new dependencies.
EngineersSee on the pull request why the gate is pending or failed, and what it needs to pass.
Enforced and recorded
Fails closed at the gate, recorded with every delivery.
The gate decides on the server and blocks at the source control platform where your branch protection requires it.
Enforced
Fails closedA missing score from a registered source, or a missing approval by someone other than the author, leaves the gate pending. Blocked tools, DLP findings, a low score or too many AI lines fail it.
Signed deliveries onlyUnsigned, mis-signed and replayed deliveries are refused, and source control events are recorded only from signed deliveries.
No self-approvalCI/CD runs, DevOps actions, dependencies, API specifications and refactorings cannot be approved by the person who asked.
Secrets in the vaultWebhook secrets and source control credentials are held in the vault; a webhook secret is shown once.
Recorded
GateEvery received pull request and push, every change of gate state and every result posted, or the failure to post it.
Rules and sourcesEvery rule change, review source registration and revocation, and every submitted score.
ConnectionsEvery source control connection change and webhook secret rotation.
The gate blocks a merge only where branch protection or merge checks require its check. AI attribution is detection, not proof: a rule that applies to every change cannot be evaded by removing markers.
Cloud source controlGitHub.com and GitLab.com deliver webhooks to your installation's receiver.
Self-managed source controlGitHub Enterprise Server and GitLab self-managed on your network. Calls to private addresses are allowed by your operator.
Self-hosted and in your cloudRules, results and credentials stay on your installation.
Hosted by usWe run it for you, with the same controls and audit record.
Get started
Set it up with the documentation.
What's next
Being built now.
These are in development and not part of the product today.
BitbucketThe AI pull request gate for Bitbucket repositories.
Review bot registryRegistered review bots with their own policies, action approval and merge protection rules.
Documentation driftA measure of how far documentation has drifted from the code it describes.
Infrastructure deploymentsIaC module deploys, Kubernetes cluster and ingress configuration, and platform deployments applied to real targets with rollback.
Database registryHealth checks and backups of the databases you register.
Talk to our team.
Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.