Change control (new cloud API usage signal)

Full workflow

Complete guide (limitations, CI, published lens): change-control

Why use CCE

Change-advisory boards and security reviewers need an early signal when a PR introduces new cloud API usage — before IAM policies, cost estimates, and security reviews are finalized. Diffing go.mod alone misses new call sites in existing dependencies.

CCE flags new entitlement rows in PR scans so change control can gate merges that expand cloud footprint.

Example command

cce diff baseline.json pr-entitlements.json --fail-new

Analysis recipe

This use case is registered as recipe change-control — run with:

cce run -folder . -language AUTO -recipes change-control -output change-control.json