ProposedOn the path to acceptable
SAST and invariant tests as a merge gate on generated diffs
If a model wrote it, a machine must also try to break it before a human stamps it.
No compiled flow or public database names this control yet.
Who should own it
Engineering orgs
Enterprises
How quickly it can land
Days
A crash team can ship it inside two weeks.
Expedited implementation
2 weeks
14 calendar days with a crash team
Normal implementation
2 months
60 calendar days as a planned program
Risk this mitigates
15Given that AI coding tools are already in the provenance of public CVEs, and they are being adopted as the default author of new code, there is a possibility of a correlated class of bugs shipping across many products at once resulting in a software ecosystem whose defects an attacker can study once and exploit many times.
Residual composite 15 · still above the threshold
Effect if implemented
Applied to every failure scenario on that risk, then re-ranked. Axes are clamped at 1.
- Likelihood
- −1
- Consequence
- −1
- Urgency
- −0