Software Supply-Chain Security Moves to Trusted-Tool Control

LiteLLM breach reporting, weak assistant provenance checking, MSP privilege abuse, and agentic AppSec guidance strengthen the shift from SBOM inventory to install-time and runtime enforcement. Provenance, signed artifacts, isolated runners, scoped CI/CD identity, continuous third-party review, secret protection, and independent validation are emerging control layers, with EU CRA reporting obligations adding regulatory pressure.