Source summary On September 24, 2026, NIST NCCoE released additional resources including mappings between the Secure Software Development Framework (SSDF) and a DevSecOps reference model, with examples of CI/CD automation and container deployment. Its next demonstration, Build 3, is planned to address agents performing development, build and testing alongside their identification, authentication and authorization. Build 3 is at the scoping stage; it is not a completed standard or published demonstration result. TABS Company's business perspective Companies adopting AI for development should first identify repetitive tasks and separately define access to repositories, build environments, secrets and deployment systems. Start with a small pilot that names those responsible for code review and deployment approval, and records changes made by agents. Evaluate the burden of correcting errors and the ability to control permissions as well as productivity.