Two fronts opened at once. Software synthesis moved from autocomplete to stateful, autonomous ecosystems, and under the official programmes a parallel one grew: unsanctioned tools, models and agents, embedded straight into daily work. Perimeter AppSec and static governance do not reach either, and bans keep failing - they only push the work onto personal devices. This paper answers on two axes: a technical pipeline, from an open intake register to least-context access control, and a social one, because inclusive leadership is the catalyst that makes the pipeline work at all.