A water utility wants approved Claude Code plugins tracked like other software. What configuration practice fits?
Select an answer to reveal the explanation.
Short Explanation
If it loads next to plant code, it belongs on a bill of materials. You track Claude Code plugin dependencies like any other approved software instead of stashing keys in env files, letting workstations auto-update, or calling a release note good enough.
Full Explanation
Claude Code plugins that load beside water-utility engineering work are software dependencies, not disposable chat toys. Tracking plugin dependencies in an approved bill of materials works because inventories record names, versions, sources, and owners the same way other plant-adjacent tooling is tracked for audit, vulnerability response, and change control. Utilities can approve a small set of plugins and detect unapproved installs before they become ambient risk next to SCADA-adjacent repos. Storing plugin API keys in project environment files fails because secrets checked into source or left in plain-text env files create an unmanaged supply-chain and data-exfiltration risk next to plant repositories. Enabling automatic plugin updates on team workstations fails conceptually by skipping supply-chain visibility and reproducible developer environments, since silent changes can introduce unvetted code next to plant repositories. Documenting plugin usage in release notes for stakeholder review fails as governance because release notes are not an approved inventory or access control, and stakeholder awareness does not replace an enforced bill of materials. Exam caveat: a bill of materials is only useful if installs are actually constrained to the approved list and versions are updated through a review path rather than silent auto-updates. Operational check: maintain an approved Claude Code plugin BOM with versions and owners, block or alert on unlisted plugins in developer endpoints, and include the BOM in periodic OT/IT security reviews for the water utility.