Operations | Monitoring | ITSM | DevOps | Cloud

In the fast-paced world of modern software delivery, compliance is often a bottleneck. While our existing OPA-based Policy as Code feature has long empowered teams to encode complex authorization checks and enforce granular governance across their DevOps workflows, we know that starting from a blank page can be daunting. Security and governance teams struggle to keep up with the volume of releases, while developers often find the initial setup of these policies to be time-consuming.

Every HTTPS connection starts with a TLS handshake. It’s the security check, answering “are you who you say you are?” and “how are we going to keep this conversation secret?”. There’s a lot going on during the handshake, and there used to be even more before it all got hacked and removed. And that’s useful to understand, the modern TLS 1.3 handshake is short because everything else got compromised.

The numbers from the 2026 State of the Database Landscape: AI Edition are striking. 99% percent of respondents using AI report at least one measurable benefit for their database work. Automation is up, performance is improving, and three-quarters report significant cost savings. By almost any measure, AI is delivering. However, sitting alongside that near-universal positivity in the same dataset, security and privacy concerns have climbed to 64%. Regulatory compliance anxiety has risen to 40%.

When we launched Autonomous Worker Agents, the message we led with was simple: governance is inherited, not integrated. Agents don't get security bolted on after the fact. They inherit the OPA policies, RBAC, and audit trails already running your production pipelines. This post is about the layer underneath that promise: isolation. We let an Autonomous Worker Agent run shell commands and call APIs inside our pipelines.

Today, we are pleased to announce the release of CFEngine 3.28.0! The code word for this release is introspection. This is a non-LTS, not supported, feature release, with features which will become part of the next LTS scheduled for summer 2027.

In the previous post in this series, we covered why Virtual Machine (VM) Live Migration in Kubernetes is difficult: a VM’s IP is its identity, and the “new” VM on the destination node has to come up with the same IP, this something that Kubernetes is not known for, and on top of that, traffic has to switch over only after network security policies are in place.