Decide by policy, gate behind a human, verify by read-back, record a hash-chained ledger.
Free
Scanned where there is a package or repository to read, and every release diffed against the tool surface we already hold.
Decide by policy, gate behind a human, verify by read-back, record a hash-chained ledger.