Last updated September 18, 2026
4 min read
Security can approve the AI tool and still leave the workflow unmanaged.
In this article
Approval is not the same as control
Procurement approval answers one question: may the company use this tool?
Delivery control answers a different question: what happens when the tool changes the codebase? Those questions often get collapsed. The company approves Claude, Gemini, Codex, Copilot, or Cursor, then assumes the workflow around them is handled by developer judgment.
That gap shows up in normal work. Nobody knows whether the agent can edit migrations. Security rules exist in one instruction file but not another. A risky change gets a good-looking diff but no decision record. The tool was approved. The operating model was not.
This creates awkward conversations later. Security asks whether an agent touched auth code. Engineering answers that it probably did, but only in a small pull request. Product asks who approved the implementation path. Nobody can point to a decision record. The company did not lack a policy. It lacked a workflow that left evidence behind.
The workflow needs boundaries
Security teams care about boundaries because agents do not understand organizational risk by default.
A repository may contain billing flows, authentication, customer data paths, infrastructure scripts, and generated files. A human developer may know which areas are sensitive. An agent needs that boundary stated in files, rules, workflow gates, or retrieved context.
| Question | Tool approval answers | Workflow control answers |
|---|---|---|
| Can we use this vendor? | Yes or no | Not enough |
| What can agents edit? | Usually unclear | File and module boundaries |
| How is output checked? | Usually assumed | Tests, review, compliance, security gates |
| Who approved a risky path? | Usually absent | Decision records |
| What evidence remains? | Vendor logs maybe | Repo-owned artifacts |
Approval without workflow still leaves engineering to improvise risk control. That improvisation is where different teams start inventing their own rules. It also makes later audit conversations depend on memory instead of evidence.
paqad-ai makes risk visible in the repo
paqad-ai gives the workflow something concrete to load and inspect.
It can generate provider entry files and MCP config, store project profile and detection reports under .paqad/, route work through structured workflows, and use decision pauses when an implementation path needs human approval. It also includes compliance tooling and security-oriented workflows in the runtime.
This does not replace security review. It gives review a visible path to inspect.
The real failure is silent permission
The dangerous state is not an agent making a visible mistake. It is an agent making a reasonable-looking change in an area nobody meant to delegate.
The question is not only which AI tool is approved. It is which workflow is allowed.
NIST’s AI Risk Management Framework separates govern, map, measure, and manage. That distinction is useful here. A policy governs. A module map helps map. Verification and compliance measure. Workflow gates help manage. Chat instructions alone do not cover the chain.
For enterprise software teams, the control surface has to be in the repository because that is where the work lands.
A sane rollout asks sharper questions
Before expanding AI-assisted development, ask workflow questions that security and engineering can both answer.
The goal is not to slow every change. It is to stop pretending tool approval equals delivery control.
What next?
If security has approved the AI tool but nobody can describe the AI delivery workflow, the rollout is incomplete. paqad-ai gives teams a practical repo layer for rules, permissions, checks, and decision evidence.
Approve the tool, then govern the work.