DevOps Live London Day 2: Governing AI Across the Delivery Lifecycle
Written by Rebecca Uffindell Fri 13 Mar 2026
Day two of the DevOps Live Keynote theatre focused on how AI is being embedded into production systems, and what that means for governance, reliability and accountability.
Where earlier sessions explored enablement and structural transformation, the second day concentrated on operational execution. As AI agents become integrated across CI/CD pipelines, observability platforms and remediation workflows, the central question shifts from acceleration to control.
Across sessions, speakers returned to a shared theme: AI is increasingly part of the delivery control plane, and its effectiveness depends on how well organisations supervise, measure and constrain it.
CI/CD as a Governance Engine
Sanmat Jhanjhari, DevOps Lead at Nationwide, reframed CI/CD not simply as a pipeline toolset, but as an enforcement and visibility platform.
“What if CI/CD wasn’t Frankenstein’s of tools,” he asked, “but a single unified platform?”
Within Nationwide’s environment – comprising 5,000 engineers, 5,000 repositories and more than 80 million lines of code – fragmentation had become a scaling risk. Tool rationalisation, policy-as-code enforcement and persona-driven dashboards were introduced to restore clarity.
Every repository now carries ownership metadata. Pull requests are evaluated through Open Policy Agent. Non-compliant changes are blocked, but developers receive remediation guidance.
“Developers know what they are supposed to do in order to be compliant,” Jhanjhari explained. “Look at the fix guide, go and do the stuff… and the PR is unblocked.”
This approach transformed governance from a periodic audit to continuous feedback. Compliance improved once dashboards were made visible, and enforcement was automated. Inactive repositories were surfaced and archived. Duplicate scanning configurations were eliminated. The CI/CD platform became the operational source of truth across engineering roles.
The shift embedded accountability directly into the workflow.
From Alert Noise to Assisted Remediation
Mahendran Selvakumar, Cloud and DevSecOps Engineer at Tata Consultancy Services Limited, addressed a familiar challenge: alert fatigue.
“In that DevOps team, we need 10,000 alerts,” he said. “80% duplication and non-actionable alerts.”
His session demonstrated an AI-driven DevOps assistant designed to ingest logs, metrics and topology signals, correlate context and present structured remediation steps. Rather than requiring engineers to manually investigate every alert, often spending “40 minutes… finding the alert, analysing the alert”, the assistant aggregates signals before proposing action.
A live Kubernetes demonstration illustrated fault injection, automated diagnosis, Slack notification and guided remediation approvals.
However, Selvakumar emphasised staged trust.
“Don’t put that particular chatbot directly in production. First, you need to trust that particular chatbot.”
The rollout model he described – sandbox, development, then production – reinforced a broader lesson: operational trust must be earned progressively.
AI augments the on-call engineer; it does not remove the need for oversight.
Trust as an Engineering Discipline
Dylan Morley and Rob Hill, engineers at ASOS, examined AI integration through the lens of delivery safety.
“We need to ensure that we trust this process,” Morley said, “without humans having to check every single line of code.”
They described AI interaction modes ranging from advisory to autonomous. As autonomy increases, usefulness grows, but so does risk.
“The more ability that you give an agent, the more useful it becomes,” Morley noted, “but the more risk you take on as well.”
At ASOS, AI-generated code is paired with deterministic toolchains. OpenAPI specifications generate typed clients. CI pipelines enforce validation. AI expands test packs, but automated validation gates remain mandatory. Golden paths through Backstage templates embed non-functional requirements – telemetry, error handling and feature flags – into repeatable patterns.
“Don’t let the AI try to create that each time,” Morley advised.
Deployment safety has also evolved. Rob Hill described ASOS’s progression from manually verified blue/green releases to canary deployments governed by Istio and Flagger.
“The system became the decision maker.”
Traffic shifts incrementally (25%, 50%, 75%) while automated health metrics evaluate performance. If thresholds are breached, rollback occurs without manual intervention.
In one early incident, automation reversed a deployment that engineers initially believed was stable, exposing blind spots in dashboard-led validation.
The lesson was structural: deterministic systems and non-deterministic AI can coexist when governance and measurement frameworks are robust.
As Morley summarised:
“Where the deterministic and non-deterministic meet – that’s the sweet spot.”
Reliability Beyond Monitoring
Benjamin Chiro, Senior Staff DevOps Engineer at SSE Plc, examined reliability through the lens of observability.
“Traditional monitoring tells you something is broken,” he said. “Observability tells you why.”
He described an outage where infrastructure metrics appeared healthy, CPU and memory stable, while users experienced severe latency. The root cause lay within a downstream dependency invisible to surface dashboards.
“The lesson we learned – we did not have a reliability problem. We had an observability problem.”
Observability correlates logs, metrics, traces and profiling data to reveal system behaviour rather than component status. AI-enhanced observability extends that capability to anomaly detection, failure prediction and root cause suggestion.
“AI observability predicts and waits for failure,” he said. “The other prevents it.”
Chiro outlined a progression from reactive monitoring to correlated observability, then intelligent root cause detection and predictive reliability. He cautioned against treating AI as an objective in itself.
“AI is not a goal on its own. Define specific KPIs.”
Adoption must be tied to measurable improvements in incident frequency, mean time to resolution and customer experience.
From Assistance to Accountability
Across the sessions, a consistent operating model became visible. Policy-as-code enforcement embedded directly into CI/CD pipelines ensured that governance was continuous rather than periodic. AI-assisted remediation introduced automation with staged trust models and human oversight. Deterministic validation frameworks operated alongside AI-generated code, ensuring that non-deterministic outputs were constrained by predictable guardrails. Progressive delivery models relied on automated rollback and metric-driven evaluation, while observability platforms incorporated machine learning to surface systemic behaviour rather than isolated failure.
AI is not displacing DevOps fundamentals; it is operating within them. As agents write code, correlate incidents, predict failure patterns and evaluate deployment health, accountability shifts from individuals to systems of supervision and measurement.
Day two reflected a maturing phase in DevOps practice. The focus is no longer simply on enabling AI within workflows, but on governing it across the entire delivery lifecycle.
Trust, in this context, becomes an engineering property, designed, validated and continuously maintained.
Written by Rebecca Uffindell Fri 13 Mar 2026