The Human Supply Chain Behind AI – And Why Agent Governance Is the New Safety Valve

AI is getting cheaper, faster and more capable — but the human and software supply chains underneath it are getting riskier. As models become commoditised and enterprises flood their stacks with AI‑generated code and agents, two realities collide:

• No security team can keep up with the volume of new vulnerabilities in the software supply chain.
• AI still depends on vast amounts of invisible human labour — often low‑paid, precarious data work that raises real human‑rights questions.

This is the world Aqta is being built for: one where the model is a commodity, but governance is not.

Models as commodities, code as floodwater

In late 2025, bank and equity analysts started saying the quiet part out loud: foundation models are on their way to becoming commodities as competition intensifies and prices fall. As their costs collapse and performance converges, the differentiator shifts up‑stack — from "which model?" to "what do you build on top?"

For software teams, that has one clear implication:

If it is cheap to ask models for code, you will get a lot of code. Copilots, internal agents and code‑generation tools make it trivial to produce new services, scripts and glue logic across the organisation.

But every generated function can pull in new dependencies, touch new APIs and extend your blast radius, even if the model writes "perfect" code by static‑analysis standards.

The economics guarantee an explosion of AI‑generated code and agentic behaviour; the question is how to keep it safe once it is running.

A software supply chain no human can audit

At the same time, the software supply chain is already beyond human scale. A 2024 CVE review shows 40,009 published vulnerabilities in a single year, up nearly 39% from 2023 — roughly 108 new CVEs every day. Many are in open‑source dependencies and transitive packages, precisely the libraries AI tools are happy to import without context.

Even if your AI assistant writes "perfect" code, the libraries it pulls in may hide serious vulnerabilities. Security and platform teams are already struggling to:

• Track which microservice is using which version of which library.
• Understand how AI‑generated changes alter runtime behaviour across complex systems.

Static scanning alone is not enough. What matters is how the AI‑generated code and agents behave in production: what they call, what data they touch, what loops they get stuck in.

The invisible human labour behind AI

There is a second, less visible supply chain to consider: the humans behind the algorithm. Investigations have documented how AI systems depend on large numbers of under‑recognised data workers — labellers and moderators who clean and annotate data, often in the Global South, for low pay and with limited protections.

Reports highlight risks such as:

• Low wages and precarious contracts for data‑enrichment work that underpins commercial AI systems.
• Psychological harm from repeated exposure to toxic content in moderation and reinforcement‑learning pipelines.

Most enterprises do not have a clear line of sight from "we use this model" to "here is the labour and sourcing context behind it". Once again, the problem is one of governance at scale: how to connect technical usage of models and agents to ethical standards and procurement policies in a way that satisfies both regulators and investors.

Where Aqta fits: runtime governance as safety valve

Aqta is not trying to replace static security tooling or solve labour conditions directly. Instead, it provides a governance gateway that sits in front of your AI agents and model calls, and makes their behaviour observable, controllable and auditable.

In practice, that means:

Runtime visibility over agents and AI‑generated code paths

• Centralised traces showing which models, tools and APIs an agent uses — with latency, cost and policy outcomes.
• Detection of risky patterns such as loops, abnormal tool usage or calls into sensitive systems that violate policy.

Policy enforcement across models and providers

• Guardrails that can block, suppress or flag requests when they cross defined risk thresholds (for example certain tools, cost ceilings or PII access).
• A single control plane, even when you mix "commodity" models from multiple vendors.

This is how Aqta becomes a safety valve: as model prices fall and AI‑generated volume explodes, you can still keep risk within tolerable bounds because runtime controls scale where human review cannot.

From technical risk to ethical supply chains

The same governance layer that manages technical risk can also help organisations align AI use with their ethical and procurement standards.

Concretely, you can:

Aqta does not rewrite global labour markets. It does give enterprises the observability and control to apply their own standards consistently, tying AI system behaviour to both technical security and supply‑chain ethics.

Published 5 January 2026