Prevention in agent-generated code is architecturally solved—but choosing controls that protect security without slowing development remains the challenge.