Provider and platform responsibility: publication-boundary governance for AI coding tools

The argument

The paper separates four boundaries — observation, execution, persistence and publication — and argues they cannot be merged. Execution-safe does not mean publication-safe; secret-safe does not mean semantically private; code-secure does not mean context-secure.

From public documentation reviewed through 2026-09-21 it records real progress: default security validation for third-party coding agents on GitHub (CodeQL, the Advisory Database and secret scanning), secret scanning through the GitHub MCP server, and agentic autofix that reruns the original analysis; Codex's separation of sandbox from approval, a network-off local default and isolated cloud runs; Cursor's sandbox, protected paths and team policies; Claude Code's tool permissions, plan mode and managed settings.

The review found no evidence that the major platforms already offer a generalized, semantic publication-boundary governance layer — with the caution that not found in review is not the same as absent. Instead of pushing the whole burden onto vendors or onto users, the paper proposes layered responsibility: provider baseline, platform enforcement, organization policy, repository policy and user authorization, each with explicit boundaries.