Enterprise governance for AI-generated applications
| Layer | Minimum questions |
|---|---|
| Authoring AI | Which code, prompts, secrets, and data can it access? Where are requests processed? Which tools can it run? |
| Generated software | Who reviews changes? Are tests, provenance, licenses, scanning, and authorization enforced? |
| Production runtime | Who controls identity, data, network, logs, backups, residency, scaling, and deletion? |
Classify data and repositories, restrict agent tools, require human review for material changes, apply normal CI/CD controls, and maintain a tested exit path. Vendor scanners and governance features provide evidence; they do not transfer accountability away from the deploying organization.