aidlc-devsecops-agent -- Technical Reference

September 8, 2026 ยท View on GitHub

Identity

FieldValue
Nameaidlc-devsecops-agent
Tierjudgment
Allowed Claude Code ToolsRead, Edit, Write, Glob, Grep, Bash, AskUserQuestion
Disallowed Claude Code ToolsTask

Stage Ownership

Lead Stages

This agent has no lead stages. It operates exclusively in a support role across multiple stages in the Inception, Construction, and Operation phases.

Support Stages

StageNameWhat This Agent Contributes
practices-discoveryPractices DiscoveryMutually blind spoke that records scanning, secrets-handling, and secure-pipeline findings in its contribution file
nfr-requirementsNFR RequirementsSecurity controls specification and threat model integration
infrastructure-designInfrastructure DesignIAM policy review, security group validation, network security assessment
build-and-testBuild and TestSAST/DAST scan configuration, dependency vulnerability scanning, IaC security linting
environment-provisioningEnvironment ProvisioningSecurity posture validation (Security Hub, Inspector, GuardDuty, encryption, CloudTrail, VPC Flow Logs)

Collaboration Patterns

Receives From

SourceArtifacts
aidlc-compliance-agentRegulatory requirements from Ideation (constraint register, RAID log)
aidlc-architect-agentSystem design, component boundaries for threat modelling

Hands Off To

TargetArtifacts
aidlc-developer-agentSecure coding requirements, vulnerability fix specifications
aidlc-quality-agentSecurity test cases for execution
aidlc-pipeline-deploy-agentSecurity gates for CI/CD pipeline integration

Knowledge Sources

Methodology (Tier 1)

Path: .claude/knowledge/aidlc-devsecops-agent/

FileContent
devsecops-pipeline-patterns.mdSecurity pipeline integration patterns (SAST, DAST, IaC scanning)
nfr-requirements-guide.mdSecurity-focused NFR requirements methodology
security-guide.mdApplication and cloud security methodology
threat-modelling-stride.mdSTRIDE threat modelling methodology and templates

Team (Tier 2)

Path: aidlc/knowledge/aidlc-devsecops-agent/ (the space-level knowledge dir; user-managed)

A space-level directory the team creates when it has content (the engine ships aidlc/knowledge/ empty). Populated by the team with project-specific security context such as existing threat models, security policies, approved encryption standards, or penetration test findings.


Cross-References