When AI writes code, it joins the software supply chain

This article argues that AI-driven systems create a new class of machine identities that can generate and execute actions across repositories, pipelines, and infrastructure, expanding the attack surface and outpacing traditional access-based governance. It recommends measuring AI-generated artifact footprints, authority scope, autonomous change rates, cross-system interaction surfaces, and auditability, and calls for a governance model that bounds, observes, and continuously evaluates AI behavior across workflows rather than relying solely on static permissions.