Longer notes, takes and outlooks, written by hand between the weekly pages.
Model policy belongs in your IaC, not a dropdown
GitHub's new Copilot model-policy endpoints make "which model may touch our code" readable by API, and the read half is the part worth wiring into your drift checks this month.
Internal vibe-coding platforms are shadow IT you can govern
When non-engineers ship internal tools by the hundred, the control point stops being code review and becomes the platform's identity model, data scopes and deployment defaults.
Windows is becoming the boundary for coding agents
Microsoft's plan to build agent identity, tool discovery and isolation into Windows turns agent security into an endpoint and identity problem that arrives by OS update rather than by purchase order.