Author
Mohammad Ashraful Islam
Founder & CEO, Devs Core
Ashraf is a full-stack engineer who still reads the pull requests. He founded Devs Core in Dhaka and now runs it as a US company, and he works across the same stack the team does — React and TypeScript, Django and Python, Flutter, Kotlin.
His academic background is in artificial intelligence, and he has spent five years building production software — the kind with real users, real uptime and real consequences when it breaks.
He led the builds most of this site points at: the member platform that took an institution off its office inbox, the factory accounting system that replaced a load-bearing spreadsheet, and both of the AI products Devs Core runs itself. He writes here about building and running AI agents that act inside ERP, CRM and helpdesk systems, under scoped permissions with a person approving every write.
- RoleFounder & CEO
- Academic backgroundArtificial intelligence
- Production experience5 years
- Builds inReact · Django · Flutter · Kotlin
Who is Mohammad Ashraful Islam?
Mohammad Ashraful Islam (Ashraf) is the founder and CEO of Devs Core, a US AI systems company with its engineering team in Dhaka. He is a full-stack engineer with an academic background in artificial intelligence and five years of building production software.
What does he build?
Governed AI agents that work inside the ERP, CRM and helpdesk a business already runs, under scoped permissions, with a named person approving every write and every call logged. He led the member platform for IAB’s 10,000+ members and both AI products Devs Core runs itself.
What does he write about?
Building and running AI agents in production: how an agent connects to existing systems, how its writes are reviewed, and how it earns more autonomy on the Autonomy Ladder.
Writing
Articles and case studies
- Article · An Audit Trail for AI Agents That Holds Up: Append-Only Logs, Hash Chains and What Regulators Ask ForAn AI agent audit trail records every proposal, policy decision, approval and action in an append-only, hash-chained log that shows any edit or deletion.
- Article · How to Stop Runaway AI Agent Costs: Token Budgets and Rate Limits with an AI GatewayRoute every model call through an AI gateway that gives each agent its own key, budget, rate limit and model allow-list, and reserves the worst-case cost first.
- Article · An AI Agent Deleted a Production Database in 9 Seconds. Here's the Architecture That Makes It ImpossibleAn AI agent deletes production data when it holds a credential that allows it. Scoped tokens, a policy gate, bound approvals and off-site backups stop it.
- Article · AI Agent Observability with OpenTelemetry and Langfuse: Trace Every Tool Call and DecisionTrace AI agents with OpenTelemetry GenAI spans (invoke_agent, chat, execute_tool), add policy and approval fields, and send them to Langfuse, Phoenix or Datadog.
- Article · An AI Governance Framework for a Mid-Size Company: What You Need Before Your First AI AgentA mid-size company needs a one-page AI governance framework per agent: owner, authority map, risk tier, approvals, logs, tests, a kill switch and a review date.
- Article · AI Finds Vulnerabilities Faster Than Teams Patch: A 2026 Security Checklist for Teams Shipping AIAI now finds and exploits flaws faster than most teams patch. A checklist from October 2026: same-day patching, SBOMs, fail-closed scans and keys you can rotate.
- Article · Cedar vs Open Policy Agent vs OpenFGA: Choosing a Policy Engine for AI Agent AuthorizationCedar suits per-call agent rules, OPA suits teams already on Rego, OpenFGA suits who-owns-what questions. We ran one refund-agent rule set in all three.
- Article · EU AI Act Articles 12 and 14 for AI Agents: Logging and Human Oversight in PracticeArticle 12 makes high-risk AI log events automatically; Article 14 requires people who can understand, override and stop it. Both apply from 2 December 2027.
- Article · After the Railway and OpenCode Leaks: Keeping API Keys and Secrets Away From AI AgentsSecrets in env vars and files are within reach of every process and agent. Give agents short-lived, scoped tokens via a broker, and rotate without redeploying.
- Article · How to Add Human Approval to an AI Agent with LangGraph interrupt() and TemporalPause a LangGraph agent with interrupt(), bind the approval to a hash of the exact action, and use Temporal for approval waits that survive restarts.
- Article · Your AI Agent Has Your Admin Token: Least-Privilege Access with OAuth Token Exchange and Entra Agent IDGive each AI agent its own identity and short-lived, single-API tokens. When it acts for a person, use OAuth token exchange so it never exceeds their rights
- Article · LLM Guardrails Compared for 2026: Bedrock Guardrails vs Azure Prompt Shields vs NeMo vs Guardrails AIBedrock Guardrails and Azure Content Safety are managed text checks; NeMo and Guardrails AI run in your code. What each catches, and what none of them do.
- Article · MCP Security in 2026: The STDIO Flaw, 200,000 Exposed Servers, and a Checklist Before You Connect OneMCP is safe only if no untrusted party can write a server config. What the April 2026 STDIO disclosure means, and eight checks before you connect a server.
- Article · OWASP Top 10 for Agentic Applications (2026), Explained With a Fix for Each RiskThe OWASP Top 10 for Agentic Applications lists ten risks, ASI01 to ASI10, for AI agents that plan and act. Each one in plain words, with a fix you can build.
- Article · Prompt Injection in AI Agents: Real Attacks, and Why Filters Alone Won't Stop ThemPrompt injection hijacks an AI agent through text it reads. Real attacks, why filters only reduce the risk, and the structural fixes that limit the damage.
- Article · How to Red-Team an AI Agent Before Launch with Promptfoo, PyRIT and garakRed-team an AI agent by attacking its tools, not just its words: Promptfoo for app tests in CI, PyRIT for multi-turn attacks, garak for broad model probes.
- Article · Shadow AI Agents: How to Find the Agents Your Company Doesn't Know It RunsShadow AI agents are automations that call AI models with real access but no owner on record. Find them in egress logs, OAuth grants, repos, laptops and spend.
- Article · Singapore's Model AI Governance Framework for Agentic AI: A Practical Checklist for Deploying AgentsSingapore's agentic AI framework is voluntary and asks four things: bound the risk, keep humans accountable, test and monitor, inform users. The checklist.
- Article · System Prompts Are Not Security Controls: Where AI Agent Guardrails Actually BelongA system prompt steers an AI agent, enforces nothing. Where each guardrail belongs, from filters to policy checks to database constraints, and what each stops.
- Article · Why 40% of Agentic AI Projects Get Cancelled, and the Governance Decisions That Keep Yours AliveAgentic AI projects get cancelled for cost, unclear value or weak risk controls. Six governance decisions made in week one keep a pilot alive past month four.
- Case study · AI Agent for Warehouse Operations: How We Built WareHow we built Ware: a live 3D warehouse and press shop running the real orders of real days, with an AI agent on duty that handles incidents within set rules and asks the right manager before it spends.
- Article · How to Secure AI Agents: Beyond Prompt GuardrailsSystem prompts cannot protect production data. Securing AI agents requires a deterministic access layer with strict read/write separation and human approval.
- Article · AI Agent Development Cost: Budgeting Custom Agents in 2026Custom AI agents cost $5,000 to $300,000+ upfront. Learn how US businesses budget for connector engineering, token loops, and maintenance in 2026.
- Article · Human in the Loop AI Agents: Building Reviewed Write QueuesA human in the loop AI agent stages state-altering changes in a review queue, running reads at machine speed while operators approve writes.
- Article · Membership Management System for Associations: A GuideWhat a membership management system for associations replaces, what it should do, and how to move a paper-and-phone office online, with a 10,000-member example.
- Case study · WordPress Corporate Website for a Textile Solutions Company: RH CorporationHow we moved RH Corporation, an Aziz Group company, from a static HTML site to a WordPress website its own team runs, in one month with two people.
- Case study · Restaurant Guest WiFi and Loyalty Platform: bGuestHow we built bGuest: router firmware turns a restaurant’s free WiFi into guest profiles, visits and loyalty, with email, SMS and offers for returning guests.
- Case study · Sports Field Booking App with In-App Payment: NUTMEGHow we built NUTMEG an Android app to book and pay for field slots, with the owner’s promotions and an admin view of every booking and payment.
- Case study · Pharmacy Stock App with Computer Vision: Digital Pharmacy Case StudyHow we built a pharmacy inventory app for German pharmacies that updates stock from a prescription photo or a shelf video, using OCR and computer vision.
- Case study · Multi-Agent Research System with a Human Checkpoint: CadenzaHow we built Cadenza, our multi-agent AI research system: agents plan, search and write, a person approves, and each claim is checked against its source.
- Case study · Inventory and Accounts App for a Paper Mill: Base PapersHow we replaced WhatsApp stock updates at a recycled paper mill with one inventory and accounts app: five roles, approvals, and live stock for the MD.
- Case study · Recruitment Matching App for a Talent Company: OggrowHow we built Oggrow a mutual-match recruitment app for iOS and Android, an admin web app and a brand website, replacing hiring by email and phone calls.
- Article · Devs Core Named an OpenAI Select PartnerDevs Core has been named an OpenAI Select Partner. What it means for the AI agents we build for clients, and where our work with OpenAI goes next.
- Article · How to Choose an AI Agent Development CompanyHow to choose an AI agent development company: the proof to ask for, the integration test to insist on, 10 questions for the first call, and the red flags.
- Case study · Recycling Rewards App with IoT Machine Sync: ReCyrcle Case StudyHow we built a recycling rewards app for a London company: smart machines, an eco-coin wallet on iOS, Android and web, and machine-to-app sync in under 500 ms.
- Case study · AI Personal Finance Agent: How We Built BudgeHow we built Budge, our AI personal finance agent: people record money by chat or voice, 95% of entries land correctly, and the data stays end-to-end encrypted.
- Case study · Corporate Gifting Sales Funnel for a Smart Indoor Garden Brand: Gardyn Case StudyHow we designed and built a corporate gifting sales funnel on WooCommerce for a US smart garden brand, opening a new B2B channel and a $25k first order.
- Case study · AI Support Agent Case Study: RAG + n8n for a D2C BrandHow we built a RAG customer support agent in n8n for a US D2C brand: 2,000+ tickets a day, 40% now handled by AI, live in 45 days with a team of four.
- Article · How to Get Your Website on ChatGPT (and Claude, Gemini and Perplexity)Why your site does not show up in ChatGPT, how AI assistants decide which businesses to name, and the fixes that make them able to find, read and recommend you — in the order they matter.
- Article · AI News Scraper with n8n + Firecrawl (Free Template)Learn how to build a fully automated AI news scraper using n8n and Firecrawl. This free Devs Core template scrapes daily AI news, filters content, extracts sources, and uploads to Supabase. Ideal for newsletters, blogs, and AI content workflows.
- Article · Agentic AI: How Autonomous Software Is Changing the Way Startups OperateDiscover how Agentic AI and LLM integration are transforming software development. Learn how to build intelligent, autonomous agents for your startup.
- Case study · Member Management Portal for an Architects’ Association: IAB Case StudyHow we replaced a failing portal and Excel for a 10,000-member architects’ association: membership applications that took months now close in days.
- Article · Devs Core: Now a GitHub Technology PartnerWe are thrilled to announce that Devs Core, a leading custom software development company, has officially become a GitHub Technology Partner on October 23, 2023. This partnership marks a significant milestone in our journey and aligns perfectly with our vision
- Article · Is ChatGPT Enough for Your Business? What the Data ShowsIs ChatGPT good for business? For developers and marketers, often. For operations, seats rarely change anything. What the data shows, and what moves the work.