In progress
Provenance tags on generated code in the review UI
Reviewers must know which lines a model wrote. Blind approval is the current default.
No compiled flow or public database names this control yet.
Who should own it
IDE and VCS vendors
Platforms
How quickly it can land
Weeks
A dedicated squad can land it inside two months.
Expedited implementation
3 weeks
21 calendar days with a crash team
Normal implementation
3 months
90 calendar days as a planned program
Risk this mitigates
15Given that AI coding tools are already in the provenance of public CVEs, and they are being adopted as the default author of new code, there is a possibility of a correlated class of bugs shipping across many products at once resulting in a software ecosystem whose defects an attacker can study once and exploit many times.
Residual composite 15 · still above the threshold
Effect if implemented
Applied to every failure scenario on that risk, then re-ranked. Axes are clamped at 1.
- Likelihood
- −0
- Consequence
- −0
- Urgency
- −1