The control that scales: four fields per agent. Owner, tool scope, last review, link to its action history. Everything else is a policy document describing work nobody can see.
Google's PageBreak agent found 500+ XSS bugs since January. The design rule is the story: a verification finding only counts once a validator reproduces the exploit.
Measure the pass rate on your languages, with your guidance, and whether a failing sample blocks the merge. Report via @Veracode: https://t.co/NTcoPfzD5K
Context: 82% of orgs carry security debt older than a year, 60% carry critical debt, median time to fix a flaw is 243 days. A four-point gain in generation does not move that queue.