Comment by firesteelrain

If an employee might be a supply chain risk in this analogy then they conduct background checks before they let them do anything and conduct periodic investigations. Otherwise, they don’t get access to the code base or information