Governed dependency management is a controlled way to choose, approve, and retrieve software dependencies from trusted sources. It uses policies, allowlists, curated registries, version controls, and review gates to decide what code a build or agent may fetch or install. The goal is to reduce reliance on ad hoc lookups that can pull in untrusted or counterfeit packages.
In cyber security, this matters because dependencies are a common supply-chain entry point. A malicious or squatted package can be introduced when a developer tool, CI pipeline, or AI assistant resolves a name without verification. Governed dependency management narrows that risk by checking identifiers before download, blocking unknown sources, and requiring human or policy approval for exceptions. In practice, it is one of the strongest defenses against hallucinated package names, typosquatting, and other attempts to turn a trusted workflow into an untrusted install.