Engagement 09
AI Code Governance Starter
Your assistants are adopting dependencies faster than your policy covers them.
The situation
Coding assistants are already in daily use in most engineering organizations, and the policy covering them is usually about code confidentiality. The supply chain question is newer and different: an assistant suggesting a package name is making an adoption decision, at a rate no review process was sized for.
Some of those names do not exist until an attacker registers them. The technique has a name now — slopsquatting — and it works because the suggestion arrives carrying the authority of the tool rather than of a maintainer.
This is you if
- Coding assistants are in daily use and no policy describes what they may pull in.
- Agents have tool access and nobody has reviewed what those tools can reach.
- You cannot distinguish AI-generated code from authored code at review time.
How it runs
- Week 1
Find what is actually in use
Which assistants, which agents and which MCP servers, and what each one can reach. This is usually wider than the policy assumes and wider than the platform team knows.
- Weeks 1–2
Put the policy where it resolves
An approved package and model policy enforced at the point of install rather than at review, with hallucinated-dependency and typosquat checks in the path.
- Weeks 2–3
Govern the agent tools
MCP servers and agent tool permissions reduced to what each genuinely needs, plus a cooldown rule on newly published versions.
What you are left holding
- An approved package and model policy your assistants actually resolve against
- Hallucinated-dependency and typosquat checks at the point of install
- A cooldown rule on newly published versions
- An MCP server and agent tool review, with the permissions each one really needs
What we need from you
- An honest picture of which assistants and agents are in use, including those adopted without approval.
- Package manager configuration, and whoever controls your internal registry or proxy if you run one.
- A decision-maker for policy, because the output includes rules developers will feel.
A fixed fee that assumes nothing about access is a guess. This is the list that keeps the price the price.
What this is not
- Not a ban on AI assistance, and not a productivity review. The goal is that the tools keep being used, safely.
- Not model safety or prompt injection in general. This is scoped to what assistants pull into your supply chain and what your agents can reach.
What we can already show
Slopsquatting, hallucinated package detection and agent tool governance are modeled capabilities with named products.
Why people call about this one
The window has closed
Attacker tooling now moves at machine speed through exactly the paths developers trust. Leadership asks one question when an advisory lands, and it is not a tooling question.
The axios, GhostAction and LiteLLM compromises all share one shape: "are we affected?" with no fast way to answer
The shape of it
- Shape
- Three weeks, fixed scope
- Usually funded by
- Engineering · CISO
- Often leads to
- Supply Chain Modernization