1 min lesson
Licensing & provenance - talk about it honestly
Recall the main items in "Licensing & provenance - talk about it honestly", then connect each one to the work.
Step 1 of 2
Licensing & provenance - talk about it honestly
Senior engineers will ask about licensing and provenance of generated code. Do not wave it away. The honest framing: treat AI-suggested code with the same diligence as any code entering the repo and lean on the supply-chain controls already in CI.
- SCASoftware Composition Analysis. Scanning third-party dependencies for known vulnerabilities and license problems. Press Enter for the full definition. flags known-CVE and license-incompatible dependencies an agent might pull in.
- SBOMSoftware Bill of Materials. A list of every component and dependency in a build, like an ingredients label for software. Press Enter for the full definition. keeps the component inventory accurate regardless of who added a dependency.
- Human review remains the accountability boundary for what enters the codebase.
- Where the customer has a stricter policy, encode it as a Rule so it shapes output early.
Watch out
Do not promise that AI never produces vulnerable or improperly licensed code. No tool can promise that. Promise instead that AI changes run the same gauntlet as human changes and that review plus CI is the accountability layer.
Overclaiming on quality is how you lose a skeptical senior engineer in one sentence.