Organisational policy that defines the criteria for approving, pinning, blocking, auditing and updating external dependencies in software projects, proportional to the application's criticality level (L1, L2, L3), with a focus on reducing supply chain risk and ensuring traceability.
Organisational policy that defines the requirements for the controlled use of development support tools, including generative AI assistants (GenAI/Copilot) and autonomous agents with tool-use (A0–A4), with a focus on mandatory review of output, traceability, licence validation, autonomy mandates and the maintenance of human responsibility, proportional to the criticality level (L1, L2, L3).