Why Every Kit Ships Its Own Security Checks

Software development has historically treated security as a post-launch audit: a security engineer hands a 30-page PDF checklist to developers weeks after the code is written. In the era of autonomous coding agents, this model completely breaks down.

Checklists Must Be Executable Code

An AI agent does not read a static PDF while writing code. To influence agent behavior, security controls must exist as runnable code inside the repository itself.

This is why we retired standalone platform checklists and embedded a structured security/checks.json and automated test suite into every kit:

// Example from kits/laravel-filament-postgresql/security/checks.json
{
  "id": "AUTHZ-01",
  "name": "Filament panel multi-tenant scoping via TenantScope",
  "status": "enforced",
  "test": "tests/Feature/Security/TenantIsolationTest.php"
}

When the agent writes a new controller or panel, running the test suite immediately alerts the agent if a tenant isolation boundary was breached.