§ 1When a dependency enters your estate, you know where it came from, what licence it carries, and which version you’re running. When a thousand lines of assistant-generated code enter the same estate, most organisations know none of those things. That asymmetry is the actual problem — not whether the code is “slop”.
Quality arguments miss the point because quality is unevenly distributed and improving fast. Provenance is the durable concern: code of unknown origin, trained on repositories of unknown licence, suggested into your codebase without a record. You already own the tooling to fix this — SBOMs, attestation, commit metadata. Extend it to generated code and “slop” becomes just another supplier to manage.
The remediation posture
Inventory first: find what’s already merged. Trailer discipline second: everything new gets declared. Then triage the backlog like you’d triage a vulnerable dependency — by exposure, not by aesthetics.