AI coding is moving fast, and the teams moving fastest want workflows, history, and roles around it. Here's how Fimo builds those guardrails in.
Key Takeaways
- AI coding is gaining even more traction. Rakuten ran an autonomous coding task across 12.5 million lines of code in seven hours at 99.9% accuracy, and AI now writes more than a quarter of all production code.
- Enterprise teams are on the hunt for vibe coding guardrails. They want the governance, permissions, version history, audit logs, and code ownership found in traditional CMS systems, but they don’t want to give up on the speed and reduce costs of using Claude Code.
- Most AI builders give you code generation and stop there. Fimo is the layer that runs the site afterward, with the review, permissions and audit trail a brand needs before AI-written pages go live. Every change is a reviewed pull request, agents work in isolated environments, and everything is versioned in Git and reversible.
- The part worth getting excited about is custom agents. You describe your own review or compliance rule in plain English, set it on a trigger, and it runs itself. No workflow to wire up and babysit.
Let's start with something genuinely exciting. Rakuten handed an AI agent a single coding task that spanned 12.5 million lines of code and let it run for seven hours unattended. It finished at 99.9% accuracy in one pass. Cisco, meanwhile, reports its engineers are saving more than 1,500 engineering hours a month using AI coding agents, with build times down 20%.
Two years ago, that was science fiction, and now it's just how a normal Tuesday looks. Across 4.2 million developers between late 2025 and early 2026, AI-authored code passed a quarter of all production code, up from 22% the previous quarter, and Google reported 75% of its new code was AI-generated as of April 2026. AI coding, and the whole vibe coding movement around it, is one of the best things to happen to software in a long time. If you've prompted a working site into existence in an afternoon, you already know the feeling.
We’ve spent a decade building Strapi, an open-source CMS used by teams who cared a lot about one thing, owning and controlling their own stack, so we've watched this shift with a keen (and excited!) eye. Here's what we noticed: the teams moving fastest with AI are also the ones quietly building process around it. That's the story of this piece, and it's a happy one.
Vibe code governance and guardrails: What the fastest teams are adding
Look closely at the Cisco and Rakuten studies referenced above and you'll see that both pair the AI coding agents with human review, role-based access, and audit logs. Cisco's deployment runs through SSO with mandatory review on what the agents produce. Rakuten's autonomous run happened inside a governed pipeline, not straight to production.
That's not a criticism of the AI, it's what shipping at scale has always looked like. When one engineer, or one agent, can generate thousands of lines in an afternoon, the questions that decide whether you can ship it become the interesting part: who reviewed it, whether you can roll it back, who's allowed to push it live, and whether you own what came out. None of those are new questions, they're the same ones mature engineering teams have answered for years, and the process is just catching up with how fast the tooling now moves.
Those questions have good answers that teams have used for years, they just live in a mature software workflow: version control, pull requests, staging, roles. The gap is that most AI website builders give you the generation and none of the workflow, and that's the part Fimo adds. Here's how it works, guardrail by guardrail.
Vibe code with any tool, retain code ownership with Fimo
Start here, because every other guardrail depends on it. If you can't export the code and take it somewhere else, you can't fully audit what's in it, and it isn't really yours. This was the founding idea behind Strapi and it carried straight into Fimo. Fimo works on real, Git-based code, Next.js or React pulling from Markdown. You can see every file and take it all with you whenever you want. There's no proprietary format to reverse-engineer and no walled garden holding your site hostage.
That ownership is what makes compliant vibe coding* possible in the first place, because an auditor can read the code, a new agency can pick it up, and nothing about your site is locked inside a tool only Fimo can open. It's also the difference between an autonomous website your team controls and a black box that happens to render pages.
Compliant vibe coding: Every change is reviewed before it ships
This is the core of vibe coding governance*, and it's a workflow point rather than a scanning one. Code scanners are useful, run them, but a scanner checks the code. It doesn't know whether a person looked at the change before it went live.
Fimo puts every change, whether a human or an agent made it, through a Git pull request that someone approves. An agent that commits straight to production is a colleague with no manager, and an agent that opens a PR is just a colleague, which sounds like a small difference and is really the whole game. Your CI still runs, your reviewers still review, and nothing reaches a live page without passing the same gate a human change would.
This is exactly the pattern Cisco and Rakuten built by hand. In Fimo it's the default, so the review discipline your security and brand teams already require is built in, not a governance project you have to scope, staff and maintain.
Fimo agents work in isolated environments
Fimo is home to agents that handle SEO, translation, media generation, and more. Plus, you can build your own skills and agents for specific tasks or to automate entire workflows. And the best part? Each agent runs in its own environment with a dedicated server, database and asset bucket, and it can't reach production from there.
That isolation is what makes fast experimentation comfortable. An agent can try something ambitious, and the worst case is a branch you don't merge rather than a change on your live site. You get the upside of letting agents move quickly without the version of the story where a change nobody reviewed lands on a page a customer is looking at. It also means several agents can work in parallel on heavy jobs, like a full-site audit, without competing for the same budget or touching each other's work. Safe vibe coding* isn't about slowing the agent down, it's about giving it a space where speed is free of consequences.
With Fimo, everything is versioned and reversible
Every change on a Fimo site is tracked, and every change can be undone.
This isn't checkpoints or a single level of undo, it's a real history of who changed what and when, human and agent alike, and because it's real Git history you roll back the same way your engineers already do rather than through some separate CMS version panel. That's the audit trail that turns a mistake into a thirty-second fix instead of an afternoon of detective work, and it's also what a compliance review actually asks for: show me what changed, who approved it, and prove you can put it back. A staging preview sits alongside the history, so anyone can see a change in context before it goes anywhere near the live site.
For a marketing team, this is what makes it safe to let a non-developer near a live brand site at all. Nobody can break something permanently when every version is one commit away, and every change carries a name and a timestamp for whoever has to sign off on it.
Roles and permissions decide who can do what (and when)
Role-based access sits over all of it, with viewers, reviewers and editors each getting a defined scope.
A contributor can draft without being able to publish, a reviewer can approve, and a local manager can edit their own pages and nothing else. The same principle applies to agents, where an agent proposes and a person with the right role approves. It's how you let a lot of people, and a lot of agents, work on one site without anyone being able to do something they shouldn't. That's what governance looks like when fifty people across a few markets and business units all touch the same brand site.
The exciting part: Fimo lets you build your own guardrails
Everything above is roughly what a mature engineering team expects, and here's the part that's genuinely new.
Fimo lets you build your own agents, and that includes agents that encode your own rules. If your brand needs every image to carry alt text, if your legal team needs a disclaimer on any page mentioning pricing, if your compliance policy needs a specific check before anything in a regulated section publishes, you can build an agent that does exactly that, set it on a trigger, and let it run in its own environment and open a PR like any other contributor.
And here's the difference that matters: you don't wire up a workflow and then own it forever. Other platforms hand you a visual builder, a canvas where you drag nodes, configure each step, test it, debug it, and maintain it as your setup changes, which is software development with a nicer interface, and somebody on your team has to be that somebody. Fimo asks for a sentence instead, so you describe the rule you want kept true and the agent works out which files to touch, and when the rule changes you rewrite the sentence rather than reopening a workflow.
Your process stops being a document someone is supposed to remember and becomes an agent that runs itself. That's the piece no generation tool offers, because it isn't a feature you pick from a list, it's a platform you extend with the checks you actually run. For an enterprise brand, that's often the whole reason to adopt Fimo rather than bolt governance onto a tool that was only ever built to generate.
Ship vibe-coded sites your brand can stand behind
AI coding tools write the code, and they write it well. What they mostly don't give you is the layer that lets a team ship that code with confidence: review it, version it, roll it back, and decide who's allowed to push it live.
That layer is why we built Fimo. The generation was never the hard part, and it's only getting better. What's missing from the stack is the part that runs the site after launch, and completing that is what turns a fast prototype into a site your brand, your legal reviewers and your security team are all happy to put their name on. If you're already building with a coding agent, whether that's Claude Code, Cursor or Lovable, connect the repo to Fimo and give the whole thing a workflow. You keep the speed, and the confidence is the part you add.
