BlueFlag Security has added governance controls for AI coding agents across the software development lifecycle, targeting a growing blind spot created when autonomous tools write, approve, or deploy code under employee identities.
The generally available capabilities classify agents from their activity, identify the human or machine identity they use, and record whether they were approved. BlueFlag also says the platform can find AI tools on developer endpoints through CrowdStrike and SentinelOne integrations without requiring another endpoint agent.
New human-review checks flag pull requests and deployments that appear to have bypassed manual approval. Security teams can require sign-off before code is merged or deployed, while an application inventory maps AI-enabled software and scores it against the OWASP Top 10 for Agentic Applications.
The release also expands BlueFlag’s AccessGuard and DriftGuard remediation options. Customers can address identity and pipeline risks through guided manual steps, generated scripts, or reversible one-click fixes, according to the company.
BlueFlag tied the product launch to research it conducted across tens of thousands of human, non-human, and AI identities. The company reported that 83 percent of observed organizations used AI coding agents that had not been formally approved, and that agents had merged code without human review in more than one in five organizations. Those findings come from BlueFlag’s own customer data and have not been independently verified.
The announcement illustrates why AI coding security is becoming an identity and governance problem, not only a code-scanning problem. Enterprises need to know which agent performed an action, whose permissions it inherited, what evidence supported the change, and where a human decision is mandatory before software reaches production.