AI-generated code: Technical exposure and controls
Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 11
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
Trace the exposure path
Identify security-sensitive changes and the trust boundaries they affect. Review object ownership, tenant separation, role checks, data export and the privileges available to the coding environment.
Build a small evidence map from the initiating dependency to the identities, business data and operations it can reach. Include indirect consumers and scheduled work. An inventory entry describes a possible path; activity logs and other account evidence are needed to establish what happened on that path.
Collect the right evidence
- Classify changes involving tenant access, identity, payments and exports.
- Test cross-tenant reads, writes, exports and asynchronous jobs using synthetic accounts.
- Record asset identifiers, artifact or configuration versions, permission scope, evidence dates and the owner of each unresolved question. Do not include secret values.
Control and repair
Restrict a confirmed unsafe function and preserve the relevant release and access evidence. Let the incident owner decide whether historical access requires investigation and customer follow-up.
Correct authorisation at the trusted service layer. Add independent negative cases using separate accounts and roles, and reduce the coding agent’s access to production credentials and untrusted execution.
Prove the boundary
Demonstrate that a user cannot read or modify another tenant’s objects through direct requests, alternate endpoints or background paths. Retain the reviewer’s reasoning and the relevant tests.
Use positive tests for the business function and negative tests for the access that should now be denied. Record which environment was tested and whether it represents production. Do not treat a successful login, clean homepage or healthy infrastructure graph as a substitute for an authorization or integrity test.
Engineering handoff
A reviewed access matrix and repeatable negative tests tied to the shipped release.
A review record with risk classification, independent checks and release ownership.
Acceptance gate
Release the feature only after an accountable reviewer accepts the security boundary and the negative tests exercise behavior beyond the happy path.