Development teams can add more structure before an AI coding agent begins changing code. Google has open-sourced the Elephant-Goldfish Model plugin, which requires an agent to write and defend a design document first. Fresh AI sessions then explain the plan, challenge assumptions, find ambiguities and make a final go or no-go decision. Google says thousands of its employees use the plugin daily for production code.
Why It Matters
The workflow addresses context loss and unchecked design errors rather than serving as a complete security review. For leaders: faster AI-assisted development needs review gates that preserve system understanding. For defenders: add a security-focused reviewer persona because security weaknesses are not explicitly included in the default review list. The plugin currently works in the Antigravity development environment, with support for others planned. The larger lesson is that independent context can help expose assumptions shared by an original agent session.
What Defenders Should Do
Add a security-review persona to the workflow and require approved designs before AI agents modify production code.