A logistics firm's developers source a third of new code, including payment logic shipping in two weeks, from an AI coding assistant. The coding standard and review gates never mention assistant output. What should the security manager do FIRST?
A. Run static analysis on the AI-written code
B. Suspend the assistant pending vendor security review
C. Extend the coding standard and review gates to assistant output
D. Require developers to tag every assistant-written change
(Explain your answer for more points in the comments!)