Governed AI: shipping software you can trust.
AI made writing code cheap. It made trusting code expensive. The answer isn't slower AI; it's a gate with a human at it, and a system honest enough to show its work.
Here's the pattern we kept seeing. A founder describes an app, an AI builds it in an afternoon, and it works. Real users arrive. Then day two: the login breaks when anyone touches it, a webhook dies silently, row-level security turns out to have been off the whole time. The founder is now scared of their own product. Industry projections put 40% of AI-generated projects into cancellation or major rework by 2028, and roughly half of AI output carries security flaws. None of this is the founder's fault. Nothing was watching.
The tools on either side can't fix it. The app builders won't add friction; it's against their economics. The AI IDEs assume a senior engineer is reviewing every diff; that's the opposite of the promise that got people building. And review, not generation, is where the value dies: AI developers generate roughly four times the code for about 12% more delivered value. The delta is lost in the reviewing nobody has time to do.
What governed means, concretely
Governed isn't a policy document. It's a pipeline. Every AI change lands on a real repo you own, on an isolated branch that can't touch main. A second model checks the plan. The result is actually run, twice, and looked at against what you asked for. A security pass runs until it's clean or it honestly says it can't get there. And then, when everything is green, nothing merges. It stops at a gate and waits for a named human; the person who asked for the work can't be the one who approves it. That last rule is enforced on the server, not in the interface.
The same rule holds everywhere an agent touches the world. Drafting an email is free; sending it is a gate. Proposing a journal entry is free; posting it is a gate. We think this is the only honest posture for AI that does real work: agents propose, humans approve, and everything is on the record.
Honesty as an engineering constraint
The second half of trust is smaller and less glamorous: never pretend. Every number in Motif carries its provenance; live, sample, or external, you always know which you're looking at. A compliance check is green only when a real producer made it green; nobody can hand-set it, including us. When an AI key isn't configured, the deterministic floors still work and say what they are. We publish a capability matrix of what's actually real, and our marketing isn't allowed to get ahead of it.
This costs us things. Our own trust page shows our gaps. Newer surfaces carry a visible "pending independent security review" label until their review lands. We don't have a completed SOC 2 for Motif itself yet, and we'll tell you that before you ask. In a market where a compliance vendor was caught fabricating hundreds of reports, we think volunteering your own limits is not a weakness; it's the whole position.
Where this goes
Build the product with a gate on everything, and something compounds: the system that shipped your code also knows your code. Your support desk knows which merge fixed the bug. Your analytics can point at the merge that moved the metric. Your compliance evidence collects itself from the work, because the work happens where the controls run. That's not an integration strategy; it's one system of record with the studio that built your product.
We're building for the two-founder company: one of you reads diffs, one of you reads plans, and both of you need to sign off with confidence. Genuinely, that pair is the whole design brief. If you've shipped something with AI and you're now scared to touch it, bring it over; the audit is free and the findings are yours either way.
Luke · Motif