MuleSoft, the integration and API company owned by Salesforce, built Golden Gate to keep code safe as agentic development increases the volume and speed of changes, according to a June 2026 Salesforce Engineering interview with Melissa Cazalet, senior vice president of software engineering at MuleSoft. Customers run production workloads directly on MuleSoft infrastructure, so every change has to clear the same trust threshold regardless of whether a human or an AI agent wrote it. Manual reviews and post-merge checks such as static analysis, audits and penetration tests either cannot keep up or come too late.
Golden Gate is an AI-powered governance layer that runs at pull-request time across every enrolled MuleSoft repository. It looks for line-level risks such as insecure dependencies, exposed secrets, vulnerable libraries, injection vulnerabilities, weak cryptography and compliance violations, and gives developers remediation guidance before a change reaches production. It runs on Prizm, Salesforce's internal pull-request governance platform, which supplies deployment, org-scope enforcement and merge-blocking.
Each check is packaged as a skill that goes through schema validation, fixture tests, open-source evaluation and backtesting on real merged pull requests. To make LLM output repeatable, every skill is run at least three times on the same corpus and only findings that reproduce in a strict majority of runs count. Skills start in advisory mode and are promoted to merge-blocking only after testing on at least five repositories, an independent audit of sample findings and 95% precision; one skill, change-impact-review, scored 45% precision across 75 pull requests and was not promoted. Developers keep override and rollback paths, and each skill is scoped to the files where it is relevant.
In the 30 days before the post, production skills ran roughly 77,000 times over more than 14,000 pull requests, and developers rejected under half a percent of findings as false positives. The enforcement-bypass skill, which flags changes that switch off safeguards such as strict mode, linter rules or CI test stages, ran on more than 2,200 pull requests and raised 369 findings, 3 of which were rejected. MuleSoft plans a Skill Factory to make the pipeline self-service for other Salesforce teams and Ambient Code Hygiene agents that open remediation pull requests for existing technical debt.