AI coding assistants are already inside most engineering organizations, officially or not. The useful question is not whether to allow them but how to give security and compliance teams visibility and guardrails without slowing delivery.
Start with the SDLC
Map where assistants touch your software lifecycle: authoring, review, testing, and deployment. Each point needs an owner and a control.
Extend to agentic workflows
Once assistants can take actions rather than just suggest code, identity, permissions, and audit trails matter much more.
[Michael: starter draft. Add your own examples and positions.]
No comments yet