AI SDLC Security, Privacy and Compliance
AI coding tools add new attack surface on top of everything a software supply chain already had - prompt injection, excessive agency, and unbounded consumption chief among them. Data classification decides what can reach an IDE assistant, a chat window, a CI agent, or an MCP connector, and every major framework from SOC 2 to the EU AI Act already has a clause that maps to those controls. This page is the threat model, the data tiers, and the framework-by-framework answer key.
Last reviewed: September 2026
The Audit Finding Waiting to Happen
An AI coding agent is not only a code-quality problem waiting to surface in review. It is an IP and PHI exposure risk waiting to surface at audit time. It reads the repository, calls external services, and can paste proprietary code or customer data into a vendor's servers, often through a chat window or CLI that a compliance team has never inventoried. The gap between what the agent can see and what the audit assumes it can see is where a finding starts.
None of this requires a different security program. It requires applying the data classification, access review, and change management that SOC 2, HIPAA, and ISO 27001 already ask for to a class of tool that did not exist when most of those policies were written. Read the threat model and the framework mapping below together: know what can go wrong, then know which standard already asks you to have a control for it.
Threat Model
| Threat | Vector | OWASP reference | Control |
|---|---|---|---|
| Prompt injection | Issue text, PR comments, README files, dependency docs, fetched web pages, MCP server responses | LLM01, ASI01 | Treat all retrieved content as data, never instructions; agents never act on embedded instructions; human approval for anything outside task scope |
| Sensitive data disclosure | Secrets, PII, PHI, or customer data in prompts, context, fixtures, or an agent's working tree | LLM02 | Data classification enforced at the input side; secret scanning on context; synthetic fixtures only; vendor retention and training terms in writing |
| Supply chain | Hallucinated packages, typosquats, malicious MCP servers, unpinned model versions | LLM03, ASI04 | Lockfile mode; registry allow list; new-dependency review gate; MCP servers reviewed like dependencies; model pinning |
| Excessive agency | An agent with write access to protected branches, deploy rights, production credentials, or an unrestricted shell | LLM06, ASI02, ASI03 | Least privilege in harness config; branch namespace; tool deny list; no self-approve |
| Unexpected code execution | Agent runs generated code or scripts in a privileged environment | ASI05 | Ephemeral sandbox; egress allow list; no production credentials |
| Memory and context poisoning | Corrupted instruction files, skills, or retrieval sources change agent behavior persistently | ASI06 | Instruction files and skills reviewed as code; CODEOWNERS on them; eval suite runs on every change |
| Insecure output handling | Generated code with XSS, injection, or weak crypto merged because it looked fine | LLM05 | SAST in the pipeline; review rules for the classes AI gets wrong most; mutation-scored tests |
| Unbounded consumption | Runaway agent loops, retry storms | LLM10 | Per-workflow budgets, attempt limits, hard caps |
| Human-agent trust exploitation | Reviewers rubber-stamp a change because the agent's summary sounded confident | ASI09 | AI comments labeled; tiered review; rework and no-comment-merge metrics tracked |
Which OWASP Edition
The LLM01 to LLM10 codes above come from OWASP's Top 10 for LLM Applications 2025; the ASI01 to ASI10 codes come from the Top 10 for Agentic Applications 2026, published 12-09-2025. OWASP released a 2026 edition of the LLM Top 10 in 08-2026 and an Agent Control Standard v0.1 on 09-01-2026; re-verify the mapping before citing that later edition. The Secure Coding with AI cheat sheet is the practical companion.
MCP-Specific Risk
The MCP specification's 2026-07-28 revision made the protocol core stateless and added security best practices covering confused deputy attacks, token passthrough (a server must never forward a client's token upstream), server-side request forgery through metadata endpoints, and localhost redirect impersonation. The reference filesystem and git servers, and the mcp-remote bridge, have all carried CVEs since mid-2025 - review every MCP server like an unreviewed dependency.
CISA's Guidance
CISA's "Careful Adoption of Agentic AI Services" (05-2026) is the government-issued version of the same advice: inventory every agent, apply least privilege, log everything, and require human approval before a consequential action executes.
Data Classification Mapped to AI Surfaces
| Tier | IDE assistant | Chat | Agent in CI | MCP or connector |
|---|---|---|---|---|
| Public | Yes | Yes | Yes | Yes |
| Internal | Company-managed account, training opt-out | Same | Yes, logged | Approved connectors only |
| Confidential | Company-managed, opt-out, no consumer tools | Same, no pasting into consumer tools | Yes, with audit log | Approved, read-only unless reviewed |
| Restricted (PII, PHI, secrets, customer data) | Never in prompt or context | Never | Never; synthetic fixtures only | Never |
Framework Mapping
SOC 2 (change management, logical access)
What it asks: changes authorized, tested, and approved by someone other than the author, with access kept least-privilege and reviewed.
How this answers it: a named human approver on every production merge; an agent identity with scoped access instead of a personal token; an evidence pack per release; no self-approve.
HIPAA
What it asks: PHI never leaves the covered boundary without a signed Business Associate Agreement; access is logged; only the minimum necessary data is used.
How this answers it: the Restricted tier keeps PHI out of every prompt; any vendor whose service could see PHI needs a BAA in writing; the audit log export comes from whichever vendor tier actually provides one.
ISO/IEC 27001:2022
What it asks: a secure development lifecycle (clauses A.8.25 to A.8.31), supplier security, and logging.
How this answers it: the written policy, review standards, vendor evaluation checklist, and agent audit trail map directly to those clauses.
ISO/IEC 42001:2023
What it asks: an AI management system covering risk assessment, impact assessment, lifecycle controls, transparency, and human oversight.
How this answers it: this playbook covers most of the AI management system for the engineering function; the maturity model and its self-assessment map to the standard's clauses.
NIST AI RMF 1.0 and Generative AI Profile (AI 600-1)
What it asks: four functions - Govern, Map, Measure, Manage - plus generative-AI-specific risks including confabulation, information security, and IP exposure. The core RMF is under revision with no draft published as of 09-2026; a companion Cyber AI Profile (IR 8596) is in preliminary draft, and NIST launched an AI Agent Standards Initiative in 02-2026.
How this answers it: the governance pillars cover Govern, the threat model above covers Map, the measurement stack covers Measure, and agent controls cover Manage.
NIST SP 800-218A
What it asks: secure development practices for when AI models are themselves part of the development process (the July 2024 SSDF profile for generative AI).
How this answers it: the engineering-practices and provenance controls in this playbook implement its practices directly.
EU AI Act
What it asks: AI literacy training (Article 4, since 02-2025); general-purpose AI provider obligations (since 08-02-2025, with Commission enforcement since 08-02-2026); Article 50 transparency duties (since 08-02-2026). The Digital Omnibus Regulation (EU) 2026/1744, in force since 07-27-2026, moved the Annex III high-risk obligations to a fixed date of 12-02-2027 and the Annex I product-embedded obligations to 08-02-2028. See the implementation timeline for the full schedule.
How this answers it: staff get a training record for Article 4; coding assistants are not high-risk on their face under the Commission's draft classification guidelines, but a product built with them that makes consequential decisions about people inherits this playbook's evidence pack as technical documentation, with until 12-2027 to assemble it.
SOC 2 (AI specifics)
What it asks: no authoritative AICPA guidance names AI-authored code as of 09-2026, and the Trust Services Criteria are unchanged. A nonauthoritative Technical Q&A, TQA 9561, dated 09-10-2026, addresses a service organization's use of AI in SOC examinations. Practitioner consensus routes AI-authored changes through the same CC8.1 path as any change, with the AI tool inventory sitting under CC9.2 vendor management.
How this answers it: the ticket, human review, test evidence, approval, rollback, and deploy log already required elsewhere in this playbook satisfy CC8.1; expect auditors to ask for the AI tool inventory and proof that an agent cannot approve its own change.
HIPAA (vendor specifics)
What it asks: coverage is per product, not per vendor. Anthropic's BAA covers the API and Enterprise, plus the Claude Code CLI and desktop only with zero data retention - not Claude Code on the web, managed code review, or MCP connectors. OpenAI's BAA covers the API and ChatGPT Enterprise, and Codex local, but not Codex cloud. GitHub does not sign BAAs, so Copilot is never HIPAA-eligible. Google's BAA covers Gemini Code Assist and Antigravity under Gemini Enterprise. AWS covers Bedrock and Kiro, but not Kiro Web.
How this answers it: if PHI could reach a tool, only a BAA-covered product may touch it, and the Restricted tier rule - never in a prompt - is what keeps the rest of the toolchain out of scope. See OpenAI's HIPAA-eligible products list for the current scope.
US state AI laws
What it asks: Colorado's SB 24-205 never took effect as written - stayed by a federal court in April 2026, then repealed and re-enacted as SB 26-189 (signed 05-14-2026), an automated-decision notice and documentation law effective 01-01-2027. Also in force: California SB 53 (frontier model transparency) and CPPA automated decision-making rules (compliance by 01-01-2027), Texas TRAIGA, and Illinois HB 3773 (AI in employment decisions). New York's RAISE Act takes effect 01-01-2027. Federal EO 14365 set up a preemption push, but no federal preemption law had passed as of 09-2026.
How this answers it: these laws target products that make consequential decisions about people, not coding tools themselves. If your product does, the ticket contract's rule ID and the release evidence pack (see Templates) are the documentation these laws ask for. Track by state - the map shifts quarterly.
SLSA and Sigstore
What it asks: build provenance and signed attestations. SLSA v1.2 (11-2025) finalized the Source track; Source L4 requires two-party review, which an agent cannot satisfy alone. No SLSA track or in-toto predicate exists yet for AI-generated code specifically.
How this answers it: add the agent identity to the attestation for agent-opened PRs; npm trusted publishing over OIDC, with classic tokens revoked November 2025, removes long-lived publish tokens from agent reach.
Where It Fits in AIDLC
Security is not a phase - it runs through all five. Analyze decides data classification and vendor BAA questions before a tool is adopted; Ideate threat-models the surfaces a new feature exposes to an agent; Develop runs SAST, secret scanning, MCP review, and sandboxing; Launch requires the evidence pack and a named approver before production; Curate feeds incident review back into the control set.
Frequently Asked Questions
Not on their face. The Commission's draft classification guidelines from May 2026 do not name coding assistants as high-risk, and Article 4 AI literacy and Article 50 transparency obligations apply broadly rather than triggering Annex III. The Digital Omnibus Regulation (EU) 2026/1744, in force since 07-27-2026, pushed Annex III high-risk obligations to 12-02-2027, so a product that does make consequential decisions about people has until then to comply.
No. PHI is Restricted tier data, which this playbook's data classification never allows into a prompt, chat, CI agent, or MCP connector, regardless of vendor BAA coverage. Coverage is per product, not per vendor: Anthropic's BAA excludes Claude Code on the web and MCP connectors, GitHub does not sign BAAs at all, and OpenAI's covers the API but not Codex cloud. Use synthetic fixtures instead.
No authoritative AICPA guidance names AI-authored code as of 09-2026, and the Trust Services Criteria are unchanged. A nonauthoritative Technical Q&A, TQA 9561 dated 09-10-2026, addresses AI use in SOC examinations. Practitioner consensus routes AI changes through the same CC8.1 path as any change: ticket, human review, test evidence, approval, rollback, deploy log, with the AI tool inventory under CC9.2 vendor management.
Build the Control Before the Auditor Asks
See the five governance pillars this framework mapping assumes, then bring the rest of the playbook together.