ICE seeks vendor to build agentic software factory
Months after ICE's CIO said the agency wasn't planning on AI agents, the RFI now bars any agent from approving its own release.
TL;DR
ICE published an RFI Friday seeking a vendor to build an "agentic software factory," with three layers from governance to an independent assurance boundary for pre-production testing. The design rule requires that generation, assurance and authorization stay distinguishable, and no autonomous component may silently expand its own permissions or approve its own release. Responses are due Oct. 16. ICE also asks vendors to recommend how evaluation can distinguish genuine hands-on capability from polished generative-AI proposals.
ICE's May posture was clear. "We are not using a lot of those features," CIO Dustin Goetz said of AI agents in mid-May, "and we're not planning on it." A little over four months later, the agency opened a request for information, first reported by FedScoop, to build an "agentic software factory" on top of its STELLA platform and DevSecOps pipeline. The RFI is market research rather than a contract, but the architecture it sketches is the interesting part: three layers that run from governance through an independent assurance boundary.
The design rule is written as a constraint on autonomy. The RFI says no autonomous component may silently expand its own permissions or approve its own production release, keeping code generation separate from release authority. That is governance by construction: the layer that runs agents can't double as the authority that authorizes releases. It's the kind of separation a compliance reviewer would otherwise have to impose after the fact.
The RFI closes with a question that cuts both ways. ICE asks vendors how the government should evaluate proposals to distinguish genuine hands-on capability from output a generative model can produce. An agency building an AI software factory is simultaneously worried that vendor sales may be faked by AI. It also anticipates requiring the vendor to assume continuous monitoring of its enterprise data and analytics ecosystem. Responses are due Oct. 16.
Published ·Deep Fathom