Generated output stays untrusted in our pipelines until a named human reviews it. In practice that means automated security scanning across AI-authored changes, contract-first validation that checks implementation against a specification, and explicit approval before merge and release. Dependency and provenance checks cover anything an agent pulls in.