Guardrail your organizational standards

Every organisation has rules for how software gets built and shipped. Guardrails check them automatically on every change, so risky mistakes are caught before they merge, every team works to the same standard, and you can prove it whenever someone asks.

Start free See what you get

Works with the CI you already run. More than a hundred ready-made rules, live in a day.

125

Ready-made rules

13

Language ecosystems

29

Areas covered

1

Command to adopt

Safer releases in weeks, not quarters.

Every organisation has standards for how software is built and shipped. They are agreed in design reviews and written into wikis and onboarding guides. Then a deadline arrives and nothing checks them. Each team drifts its own way. Older services fall behind and new ones copy whatever came before. Nobody notices until an incident or a customer security review or an audit asks for proof.

The usual fixes do not hold. Scripts get copied between repositories and quietly break. Manual reviews depend on who happens to be looking. Spreadsheets of controls are out of date the day they are finished.

Guardrails turn those standards into automatic checks on every change. Leaders get one view of where every team stands and which risks matter most. Developers get clear fixes on their pull requests while the work is still fresh. Auditors get evidence on demand instead of screenshots and promises. Here is what the first months look like.

Day 1 · Connect

Value from day one

Runs on the CI you already have. No migration and no agents. Switch on proven rules or add your own.

3

rules live

Week 1 · Observe

See every risk across every team

Report-only mode gives you an organisation-wide baseline without slowing anyone down.

61%

compliance baseline

Week 2 · Fix early

Fix issues at the cheapest moment

Developers resolve problems on the pull request before they become tickets or audit findings.

78%

compliance

Month 1 · Enforce

Stop incidents before they ship

Every change is checked before it merges so risky ones never reach production.

92%

compliance

Ongoing · Prove

Prove compliance on demand

One standard for every team. Answer audits and customer reviews from a report in minutes.

98%

compliance across every team

Illustrative figures. Track your own compliance trend in the team view.

Know your posture

One view shows how far each team, project and service is from the standard, and whether that is getting better. See where a single shared fix would do the most good, and which services are not being measured at all.

  • Adoption shows how much of the organisation is covered.
  • Compliance shows how much of it meets the standard.
  • Trends show whether it is improving month on month.

Checks run wherever the CLI runs. Recording results and the team view come with a paid plan.

Easy setup in three simple steps

There is nothing to install on your infrastructure and nothing to migrate. Guardrails run inside the pipeline you already have and your first results appear on the very next pull request.

  1. 01

    Choose your rules

    List the rules in buildnote.json and start in report-only mode with the ones that would have prevented your last incident.

    "guardrails": {
  "failOn": "never",
  "checks": [
    { "use": "docker/base-pinned@1.0.0" },
    { "use": "secrets/no-hardcoded-credentials@1.0.0" }
  ]
}
  2. 02

    Add one step to your pipeline

    Run the command after your build in the CI you already use. It gathers the evidence once and checks every rule on your own runner.

    - name: Guardrails
  run: buildnote guardrails
  env:
    BUILDNOTE_API_KEY: ${{ secrets.BUILDNOTE_API_KEY }}
  3. 03

    Switch on enforcement

    Results appear on the next pull request and in the team view. When the team is ready one setting turns reporting into enforcing.

    "guardrails": {
  "failOn": "error"
}

More than a hundred ready to use rules

Maintained, tested and open source, covering the areas where most organisations carry risk, across the languages and CI platforms your teams already use. A few examples:

Security

Stop the mistakes attackers look for before they reach production.

  • No credential file in the checkout
  • Workflows declare the token permissions they need
Supply chain

Know what every artifact is made of, and refuse what you do not allow.

  • The build produced a software bill of materials
  • No component carries a licence the team refuses
Infrastructure

Containers and cloud configuration built the same safe way in every team.

  • Dockerfile base images are pinned
  • Terraform state is encrypted at rest
Delivery

Changes small enough to review and traceable back to the work that asked for them.

  • Commits reference a work item
  • The change is small enough to review
Ownership

Every file has an owner and every repository explains itself.

  • CODEOWNERS covers everything
  • Repository documents how to report a vulnerability
AI coding agents

Agents in your pipelines held to the same standard as your engineers.

  • Claude runs in CI without bypassing its permissions
  • Repository instructs the coding agents working in it
Pipelines

CI definitions locked down before the next run can be abused.

  • Workflow steps pin the code they run
  • No workflow interpolates untrusted text into a shell
Tests and quality

The reports your build already produces turned into a quality bar every team meets.

  • No test failed or errored
  • Coverage is at or above the floor
Languages

Versions declared and dependencies locked across thirteen language ecosystems.

  • Node.js dependencies are locked
  • Go toolchain is pinned
Browse the full library

Start with three rules this week.

Pick the rules that would have prevented your last incident. Results appear on the next pull request, and you turn enforcement on when the team is ready.

Get started Browse the library