ADLC Security Best Practices for Teams Shipping with Coding Agents

* ADLC security controls what AI coding agents can access, do, install, and ship.
* Prompt rules are guidance, not controls; pre-execution hooks enforce policy on commands, file reads, and tool calls.
* Package vetting must occur when the agent requests packages, not after code lands, as post-install scans occur too late.
* Visibility requires inventorying agents, models, MCP servers, and skills in use.
* Policy enforcement uses pre-execution hooks to block or audit actions before execution.
* Agents should run in disposable sandboxes with short-lived tokens and limited network egress.
* Agent reads of repository files, web pages, and tool responses must be treated as untrusted input due to indirect prompt injection risks.
* Install requests must be evaluated before packages are installed, blocked by real-time checks for malicious packages or license violations.
* Code agents must undergo SAST, SCA, and secrets detection while code is being written.
* Findings must be prioritized based on real reachability and exploitability.
* CI/CD configurations and signing keys should remain outside the agent's runtime.
* Agent activity (identity, tool calls, policy decisions) must be logged to maintain accountability.

The narrative presents a clear tension between the speed of AI-assisted development and the necessity of traditional security controls. The fundamental pattern is that conventional security measures are applied too late in the SDLC—after code is written or after a release—while agentic workflows operate continuously and rapidly. This creates a gap where actions (like package installation or file reads) occur outside the scope of traditional review, which is then addressed by introducing "in-flight" controls like pre-execution hooks and install-time checks. The implication is that security governance must be shifted from post-facto auditing to real-time enforcement embedded within the agentic process itself.
The focus on shifting policy enforcement from soft guidance (prompt rules) to deterministic hooks demonstrates a resistance to opaque decision-making, aligning with principles of technical control over intended outcomes. The requirement to invent an inventory and enforce action policies suggests that scaling security requires treating the agent's environment as an external dependency requiring explicit management. This forces a systemic change: security must be architected into the interaction layer (Hooks, Skills, MCP) rather than bolted onto the artifacts produced. The potential manipulation pattern lies in obfuscating the true risk by focusing only on the output vulnerabilities instead of the execution path and intermediate steps where agent agency is most dangerous.
What are the missing dimensions? While the article details mechanics for controlling *what* agents do (sandboxing, hooks) and *how* to check dependencies, it touches less on the epistemological challenge: how humans build trust in automated reasoning systems that operate partially outside direct human visibility. The risk assessment framework—prioritizing exploitability and measuring coverage against outcome metrics—is a strong move toward making abstract security concepts concrete for engineering teams. The counterstrike involves ensuring these controls are not just adopted, but deeply integrated, resisting the tendency to treat agentic tools as optional add-ons rather than fundamental components of the supply chain.
What questions remain? How can the concept of "agent identity" be securely anchored in immutable, auditable records that survive session termination? If a system relies on complex policy evaluations via hooks, how do we audit the policy logic itself to prevent malicious administrators from subtly rewriting the enforcement layer? And if exploitability metrics prove contextually sound, how do we scale this evaluation across diverse application types without creating an unmanageable matrix of specific rules?