Disclaimer

This is a draft discussion paper circulated for peer review. It is independent work published in a personal capacity and does not constitute official guidance or policy of any government body. It does not mandate or recommend specific controls for any agency, system, or project. Views and analysis are the author's own.

Semantic Defects in AI-Generated Code¶

A threat model and assurance framework for high-reliability systems that use AI to generate code

v0.1.0 — Draft for Comment — 24 March 2026

Start reading Assess your exposure

AI coding tools are in active use across organisations and their contracted suppliers. These tools are productive and increasingly standard — this body of work does not recommend restricting them. It identifies a specific class of defect they produce that existing assurance frameworks were not designed to catch: code that is syntactically correct, passes all automated checks, looks right to reviewers, but makes the wrong decision about data that matters in its institutional context.

Start here¶

Governing AI-Generated Code (~13 pages) is the entry point for all audiences — it establishes the problem and summarises the response. Two paths branch from it:

For practitioners — Reviewing AI-Generated Code: A Practical Guide gives hands-on review guidance for staff who use AI to write code but do not have CI pipelines or developer tooling.
For assessment and governance — the CISO Assessment and Assessor Checklist evaluate organisational exposure against the failure taxonomy.

The Full Discussion Paper (~200 pages) is the complete technical analysis underpinning both paths.

Find your path¶

CISO / Security Adviser

Evaluate control gaps against the ACF taxonomy

CISO Assessment
Security Assessor

Assessment-ready checklist with ISM mapping

Assessor Checklist
Developer / Code Author

Five review questions with worked code examples

Practical Guide
Executive

The problem in 13 pages

Governing AI-Generated Code
Architect / Tech Lead

Failure taxonomy mapped to STRIDE categories

ACF Taxonomy

For detailed reading paths with time estimates and depth options, see the Reading Guide. You can also browse all pages by tags.

The document suite¶

Document	Pages	Audience
Governing AI-Generated Code	~13	Everyone — entry point for all other reading
Practical Guide	~23	Staff using AI to write code
Discussion Paper	~200	Technical leads, assessors, security architects