The next dependency is a trust decision.
GitHub’s package firewall puts policy at installation time. That matters when agents install software without a person watching.
What changed
GitHub’s package firewall is in public preview for Enterprise Cloud, currently covering npm. Available controls include cooldown periods and advisory checks. Preview access is free; GitHub says general availability will use metered pricing.
Go to the source ↓Why it matters
An autonomous coding workflow can move from a suggestion to executing a dependency in seconds. The installation step therefore deserves the same attention as code review.
A policy gate adds friction deliberately. Teams still need a way to evaluate legitimate exceptions without turning every blocked package into a blanket override.
What remains unproven
This is not protection for every ecosystem or an assurance that accepted packages are harmless. Enterprise eligibility and future pricing affect adoption.
The useful next step
Map which agents and build runners can install packages. Evaluate provenance checks, controlled versions and isolation alongside any registry-level gate.
Faster installation should not mean automatic trust.