---
title: "Check where generated code came from · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/reviewing-agent-output/code-provenance
updated: 2026-10-20
licence: "All rights reserved"
---

# Check where generated code came from

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Reviewing agent output](https://agentwranglers.se/playbook/ai-assisted-development/reviewing-agent-output)
- Rule: Make sure generated code does not copy licensed code you may not use, and that every new dependency's licence fits your project.
- How: AI tools can repeat code from their training data word for word. Turn on the tool's filter or reference check for public code where it has one. Run a licence scanner over dependencies in CI, and keep an allow list of licences.
- Check: CI runs a licence check with an allow list and fails on any other licence. Examples are `npx license-checker --onlyAllow "MIT;ISC;Apache-2.0;BSD-2-Clause;BSD-3-Clause"` and `pip-licenses --allow-only "MIT License;BSD License;Apache Software License"`.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers ai development playbook: https://agentwranglers.se/playbook/ai-assisted-development/reviewing-agent-output/code-provenance`.

- Previous: [Get a fresh review for risky changes](https://agentwranglers.se/playbook/ai-assisted-development/reviewing-agent-output/fresh-review)
- [Reviewing agent output](https://agentwranglers.se/playbook/ai-assisted-development/reviewing-agent-output)