Treat AI-assisted coding, testing, and review as governed production workflows. Add controls for secrets exposure, unsafe dependencies, prompt manipulation, and approval paths for changes that touch sensitive services. AI should accelerate secure delivery, not become a blind spot in the software supply chain.
Why This Matters for Security Teams
AI inside development workflows changes the control boundary. Code generation, test creation, ticket triage, and review comments can all influence what ships, even when the model has no direct deployment access. That means the risk is not just bad code quality. It also includes secrets leakage, insecure dependency selection, prompt injection through source content, and accidental approval of changes that should have been scrutinised by a human.
Security teams should treat these workflows as part of the software supply chain, not as productivity tools running outside governance. A useful baseline is NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where change control, logging, least privilege, and system integrity are concerned. The operational question is whether AI output is reviewed, constrained, and attributable before it affects production code or build artefacts.
Teams often misjudge the risk by focusing only on code correctness and ignoring the orchestration layer around the model. In practice, many security teams encounter AI-related defects only after a dependency, secret, or unsafe change has already entered the pipeline, rather than through intentional review of the workflow itself.
How It Works in Practice
The practical response is to place AI-assisted development under the same governance model used for other high-impact automation. That starts with policy: define where AI may be used, which repositories or services are out of scope, and what types of changes require additional review. For sensitive systems, AI-generated output should be treated as untrusted until it passes the same checks applied to human-authored code, including static analysis, dependency scanning, secret scanning, and peer approval.
Guardrails should also cover the interaction between the model and the development environment. If a coding assistant can see source files, issues, logs, or configuration, it may also see credentials or internal prompts. Teams should minimise the data exposed to the tool, restrict tool permissions, and separate read access from write or execution authority. Where prompts are stored or reused, they should be reviewed for sensitive content and treated as governed artefacts.
- Restrict AI access to least-privilege repositories, branches, and build contexts.
- Block secrets, tokens, and certificates from prompts, logs, and generated output.
- Require human approval for code that touches authentication, payment, infrastructure, or release logic.
- Scan AI-generated changes for insecure dependencies, license issues, and policy violations.
- Log model usage, user identity, prompt context, and downstream actions for auditability.
For teams building with LLMs or agentic tools, OWASP guidance such as the OWASP Top 10 for Large Language Model Applications is useful for spotting prompt injection, insecure output handling, and overreliance on generated content. The key is to keep AI in a supervised role inside the delivery pipeline, not an unsupervised one with broad execution reach. These controls tend to break down when development teams connect AI assistants directly to production credentials, live ticketing systems, or automated deployment paths because model outputs then become operational actions with too little human interception.
Common Variations and Edge Cases
Tighter AI governance often increases friction for developers, so organisations have to balance speed against the risk of unauthorised or low-assurance changes. Best practice is still evolving for agentic development workflows, especially where AI can open pull requests, modify infrastructure as code, or trigger tests without a developer watching every step. There is no universal standard for this yet, so the control set should be proportionate to the sensitivity of the target environment.
Some teams apply lighter controls to internal tools and stronger controls to customer-facing or regulated services. That distinction is reasonable, but it should not remove baseline safeguards such as secret filtering, dependency validation, and audit logging. If the workflow includes retrieval from internal knowledge bases or issue trackers, prompt injection becomes a real concern because malicious text can influence generated changes or review recommendations. MITRE’s MITRE ATLAS can help teams reason about adversarial techniques, while the OWASP Agentic AI Top 10 is especially relevant where AI systems can act, not just suggest.
In practice, the hardest edge cases are fast-moving DevOps environments, where automated delivery, ephemeral credentials, and distributed ownership make it easy for AI-generated changes to bypass normal scrutiny.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST AI 600-1 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 | Least privilege is central when AI tools touch repos, secrets, and build systems. |
| NIST AI RMF | GOVERN | AI in delivery pipelines needs accountability, policy, and oversight. |
| OWASP Agentic AI Top 10 | A01 | Agentic tools can be manipulated into unsafe actions during development tasks. |
| MITRE ATLAS | AML.TA0002 | Prompt injection and adversarial inputs can steer AI behaviour in dev workflows. |
| NIST AI 600-1 | GenAI workflows need output validation and data handling discipline. |
Limit AI assistant access to only the repositories, branches, and actions it genuinely needs.
Related resources from NHI Mgmt Group
- How should security teams govern interactive UI inside AI agent workflows?
- How should security teams handle credentials in AI-assisted development workflows?
- How should teams govern AI-assisted development workflows that use coding agents?
- How should security teams stop supply chain attacks in AI development workflows?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
