Adoption baseline
SignalYour approved-tools list lives in tickets, wikis, and memory.
OutcomeTurn the security-relevant packages you already use into version-bound, scoped decision records with named evidence and policy context.
A real allowlist can become a durable system of record.