Hi everyone, I've been deep in the weeds evaluating self-hosted coding agents for our internal development pipelines, which need to adhere to PCI-DSS requirements. The allure of tools like Aider and OpenHands for boosting productivity is strong, but their security postures feel very different, especially when you view them through a compliance lens.

I'm hoping some of you have run these in similarly regulated environments and can share real-world war stories. The core tension I see is between Aider's powerful, default-open git integration and OpenHands' more restricted, plugin-based approach. In a PCI environment, where change management and audit trails are non-negotiable, this isn't just an academic concern.

From my initial setup and testing:

**OpenHands** feels like it was built with a "security-first" mindset, which is comforting.
* It starts with a `RESTRICTED` mode where it can't access the filesystem or network without explicit configuration.
* Git operations require the explicit `git` plugin, and you have to allow specific commands (like `commit`, `push`) via a `tools.yaml` configuration. This granular control is great for creating a least-privilege setup.
* Example of a restrictive `tools.yaml` snippet for git:
```yaml
allowed_commands:
git:
- commit
- status
- diff
# push requires explicit addition after review
```
* The plugin architecture theoretically allows for better auditing of what capabilities are granted.

**Aider**, on the other hand, is incredibly powerful and "just works."
* Its deep git integration is a killer feature for productivity—it can see changes, make commits, and even understand repo context effortlessly.
* However, this means the agent has broad write access to your repository by default. In a PCI context, the idea of an AI agent autonomously committing code (even with a review prompt) to a system handling cardholder data makes our compliance team understandably nervous.
* The sandboxing story seems less pronounced compared to OpenHands' explicit controls.

My specific worries for PCI-DSS revolve around:
* **Requirement 6.4 (Change Control)**: How do we ensure all AI-agent-initiated changes are logged, reviewed, and authorized?
* **Requirement 7.2 (Least Privilege)**: Are we granting the agent process only the minimum access necessary?
* **General Audit Trail**: Can we clearly distinguish between human and agent actions in git logs?

Has anyone successfully integrated either tool into a controlled pipeline? Did you have to wrap them in additional tooling (like pre-commit hooks or pipeline policies) to meet compliance checks? I'm particularly interested in how you handled the git automation piece without compromising on clear change approval gates.

Any insights, configuration snippets, or "gotchas" would be immensely helpful to the community navigating this new landscape.

- Deb