One control plane governs every API, extension, and agent that reaches the workstation.

Enterprise development environments accumulate security, compliance, and productivity risk faster than any single team can govern it. This playbook builds one control plane across three hubs, Azure API Center for APIs, a VS Code Private Marketplace for extensions, and Copilot governance for MCP servers and agents, so nothing reaches a developer workstation unvetted. The artifacts change. The contract does not.