Clarion Street

The Army Is Building an AI-Powered Front Door to the ATO

·6 min read

The U.S. Army has spent two months describing a pilot it calls Project Gatekeeper, and every account of it comes from the same person: Gabriele Chiulli, the Army’s acting chief information officer. He first named it at a Carahsoft DevSecOps conference in Reston, Virginia on July 28. He repeated the pitch on a GovCast podcast the next week. He gave the fullest version at the Digital Transformation Summit on September 22. There is no solicitation, contract award, or formal program document behind it yet. What exists is a set of public remarks, and they are specific enough to be worth reading closely.

Chiulli’s phrase is “completely commercialized DevSecOps platform.” The picture from the September account is this. A vendor connects to Army-managed DevSecOps pipelines, runs its code through Army-built tools that do deep code scans and apply security and compliance checks, and comes out the other side with artifacts for an Authority to Operate package. The vendor’s developers analyze their own code with commercial frontier AI models, and that analysis becomes part of the evidence supporting an ATO decision. Industry users sign in through Login.gov instead of a Common Access Card, and they bring their own API keys for those frontier models.

The first version of the pitch was about a bottleneck. At Reston, Chiulli described a tailored version of the Army’s DevSecOps platform on NIPRNet, using AI to give commercial developers instant feedback and risk assessments, with companies uploading code containers into isolated staging areas without a CAC. The framing he reached for was Operation Jailbreak, the Army’s May 2026 “Right to Integrate” hackathon, where roughly 600 people from more than 50 companies opened APIs across 70-plus military capabilities at Fort Carson. The August GovCast was the same idea in fewer words: rapid AI code evaluation, quicker deployment authorizations, and an answer to AI-driven vulnerabilities.

The part that stays with me is the posture. The mental model most people carry for government software work is an enclave: you get a CAC, you work inside a boundary, the government controls the tooling. Gatekeeper is the reverse. Login.gov authentication instead of a CAC enclave, and vendors bringing their own API keys for the frontier models that analyze their code. Where those models run is not stated in any of the accounts. The reporting only establishes that the Army builds the pipelines and the vendor supplies the keys. The compliance machinery is being built to look like a commercial developer platform rather than a federal system. I have not seen another military service propose that shape out loud.

The policy scaffold predates the pilot. The Department of Defense has been writing toward continuous authorization to operate since a February 2022 memo from its CIO that defined cATO through three competencies: continuous monitoring, active cyber defense, and a secure software supply chain. The Army followed in December 2024 with a memo transitioning Army software to cATO through certified DevSecOps platforms and pipelines. Gatekeeper reads as the commercial-facing front door to that pipeline. I want to flag that connection as my inference, not a formal one. No public source ties Gatekeeper to either memo yet, and it should be treated as the policy context Gatekeeper sits inside, not a stated relationship.

This is the government side of the agentic compliance loop I have been writing about from the vendor side. On this site that story has mostly been commercial: Deep Fathom selling a continuously updated conformance record to contractors, and Fieldguide running the audit side inside a FedRAMP boundary. I covered both, and the underlying gap, in the Deep Fathom post and the automation-gap argument. Gatekeeper is the Army building the evidence pipeline itself, at the point where commercial software enters the Department of War. The interesting difference is who generates the evidence. On the vendor side, the vendor’s own agent produces the conformance record. Here the Army builds the pipeline and the vendor brings the frontier models that run the analysis. The evidence is AI-generated either way, and it still has to get past a human risk-acceptance decision.

Two things remain unproven, and they are the two that matter.

The first is the human decision. Chiulli has been explicit that Gatekeeper does not replace the authorizing official. The platform automates the technical work that informs a risk-acceptance call. It does not make the call. The AI-generated evidence is an input to a decision a person still owns. None of the reporting addresses whether a machine-generated evidence package will be accepted by a Security Control Assessor or an authorizing official. That is the difference between a demo and an accreditation pipeline, and it is currently unanswered.

The second is speed. “Significantly faster” is the headline claim, and it is, so far, an assertion. The Army has a parallel pilot, Army MAX, an AI procurement platform, and as of September it has published no measured speed results, no user counts, and no before-and-after data. Gatekeeper shares that gap. The public evidence for faster ATOs is a testable proposition, not yet a result.

Gatekeeper also lands in the middle of a compliance reshuffle I have covered separately, the FedRAMP move to certification classes and the July CMMC Phase II suspension (FedRAMP classes, CMMC suspension). I will not re-tread either here. The point is only that Gatekeeper is not arriving into a settled accreditation process.

Bottom line

Gatekeeper is the most concrete public example of a military service building agentic compliance into its intake boundary, and it is still a pilot described by one person at three conferences. I find the Login.gov-plus-BYO-keys posture more interesting than the speed claims, because it says something about how the Army is thinking about the boundary: the tooling is commercial, the pipeline is government-run, and the decision stays human. What no one has shown yet is whether the evidence the machines produce survives contact with an assessor, or whether any of this is actually faster. Both are the things to watch, and both are unmeasured as of now.

Sources

  1. Army’s Project Gatekeeper Aims to Speed AI-Assisted Software Approval — MeriTalk, Sep 24, 2026
  2. Army is Launching AI-Powered, Commercial-Facing DevSecOps Platform — GovCIO Media, Aug 3, 2026
  3. Army Targets New DevSecOps Initiative to Speed Code Reviews — GovCIO Media GovCast, Aug 4, 2026
  4. New Army Acting CIO Pushes AI From Enterprise to Tactical Edge — GovCIO Media, May 15, 2026
  5. U.S. Army CIO, Chief Information Officer (Acting) Mr. Gabriele Chiulli — Army.mil
  6. Army advances historic, first ‘Right to Integrate’ hackathon — Army.mil, May 31, 2026
  7. Continuous Authorization To Operate (cATO) memo — Department of Defense CIO, Feb 2022
  8. Army Transition to Continuous Authority to Operate — Army CIO memo, Dec 12, 2024, reprinted by ArmyNG
  9. FedRAMP & CMMC in 2026: what actually changed for your ATO — Anchore, Sep 22, 2026
  10. Deep Fathom Launches CMMC Compliance Readiness Suite — Deep Fathom, Apr 7, 2026
  11. The Army Is Testing AI Procurement With 1,116 Fewer Contracting Employees — Federal Hiring Data, Sep 3, 2026