Closing the Loop: How Ethical Sourcing Demands Reach the Code Review

The Age-Old Problem: Ethics in the Design Doc, Out of Sight in the Code

Ethical sourcing is a promise made in boardrooms and procurement meetings. It's a commitment to fair labor, to not buying conflict minerals, to knowing your supply chain isn't propping up modern slavery. But here's the rub: that promise, once written into a design document or a supplier code of conduct, has a way of evaporating by the time engineers are actually building the software that tracks those goods.

I've seen it happen. A team designs a system for tracking raw material origins. The design doc is thorough, with paragraphs on due diligence, on audit trails, on what happens if a supplier fails a human rights check. Then, months later, a developer is asked to add a feature for supplier onboarding. They don't have the design doc open. They just see a form with fields for name and address. Nobody remembers that the system was supposed to flag high-risk regions or require a second approval for certain countries.

That gap between intent and implementation is the killer. Not just for security, as Dropbox recently found, but for any kind of ethical or compliance requirement. The ethical sourcing team thinks they've done their job. The engineers think they're just coding a form. And the requirement? It sits in a PDF, unread, on a shared drive.

Dropbox's Fix: MCP and Dash Bring Context to Code Review

Dropbox just published a detailed post about how they're tackling a similar problem on the security front. They've built a system that connects their internal knowledge base, Dash, directly to code review. The magic ingredient is MCP, or Model Context Protocol, a standard way for AI systems to request and receive relevant context.

Here's the short version: when a developer opens a pull request, the system looks at the code changes, uses MCP to query Dash, and pulls up any related threat models or security requirements. Those documents appear right in the code review interface. The engineer doesn't have to go hunting. The context comes to them.

This isn't about automating security decisions. It's about making sure the decisions already made—the ones written down in design reviews—don't get lost in the shuffle. It's a way of turning passive documentation into an active part of the engineering workflow.

Why This Matters for Ethical Sourcing

Swap "threat model" for "ethical sourcing requirement" and you have an immediate blueprint for a chronic problem in supply chain software.

Think about it. Your company has a policy: no suppliers from certain high-risk regions unless they pass an independent audit. That policy gets encoded in a procurement system. But what about the software that tracks shipments? Or the dashboards that report on supplier performance? When a developer changes the code that calculates a supplier risk score, do they know about the policy? Do they know that the score is supposed to feed into a mandatory checkpoint?

Usually not. The policy lives in a PDF. The code lives in a repository. They never meet.

Dropbox's approach—using MCP as a standard layer to fetch relevant documents during code review—could be applied to ethical sourcing requirements just as easily. The requirements would live in a central knowledge base. When a developer touches code related to supplier management, the system would fetch the relevant ethical standards and show them right there in the pull request.

How the MCP + Dash Architecture Works

Let me break down the architecture, because it's elegant in its simplicity.

First, Dash is Dropbox's internal search and knowledge system. It indexes documents, respects existing access controls, and makes everything queryable. Think of it as a Google for internal docs, but with enterprise-grade security.

MCP is the protocol that lets AI agents ask for context. In this case, the code review agent sends a request: "Here's the changed code. What documents are relevant?" MCP routes that request to Dash, which returns the relevant threat models or security requirements.

The key is that the code review agent doesn't need to know where documents are stored or how to search for them. It just asks for context, and Dash handles the retrieval and permission checks.

For ethical sourcing, you could imagine a similar setup:

• Dash (or a similar system) indexes your supplier code of conduct, your risk assessment frameworks, your audit policies.
• When a developer modifies code that handles supplier data, the MCP layer fetches the relevant ethical requirements.
• The review interface shows those requirements, so the engineer knows what the code is supposed to uphold.

It's not about replacing human judgment. It's about giving engineers the context they need to make the right calls.

What Dropbox Learned: The Hard Parts

Ishan Mishra, the engineering lead at Dropbox, shared some honest insights about what's difficult.

First, retrieval isn't enough. Just finding a document isn't helpful if it's not the right document. In large organizations, design docs and code don't always have clean relationships. Keyword search won't cut it. You need semantic search—understanding what the code is about, not just what words it contains.

Second, false positives are toxic. Developers already get bombarded with automated feedback. If your system flags something irrelevant, they'll start ignoring it. Trust is fragile. Mishra says they'd rather be cautious and avoid noise than send every weak signal.

Third, latency matters. Code review is interactive. If the system takes too long to fetch context, developers will move on. You need to balance retrieval depth with speed.

These lessons translate directly to ethical sourcing. You don't want the system to flag every minor code change with a boilerplate reminder about human rights. You want it to be precise: only surface requirements that are actually relevant to the code at hand.

Practical Steps to Bring Ethical Sourcing into Code Review

So how would you actually implement this? Here's a rough roadmap.

1. Centralize Your Ethical Requirements

You need a single source of truth for ethical sourcing policies. Not a folder of PDFs. A structured, searchable database. This could be a wiki, a document management system, or a dedicated compliance tool. The key is that it's indexable and accessible via an API.

2. Map Requirements to Code Areas

You don't need to map every line of code. But you should identify the modules that touch ethical sourcing data: supplier management, risk scoring, audit tracking, reporting. For each module, attach the relevant requirements.

3. Set Up an MCP Server

MCP is an open standard. You can build a small server that wraps your knowledge base and exposes it to AI agents. This server handles authentication and retrieval, so the code review agent doesn't have to know the details.

4. Integrate with Your Code Review Tool

Whether you use GitHub, GitLab, or something else, you can add a bot that calls your MCP server when a pull request is opened. The bot fetches relevant requirements and posts them as a comment or inline annotation.

5. Start Small, Iterate, and Get Feedback

Don't try to cover everything at once. Pick one workflow—say, supplier onboarding—and pilot it. Collect feedback from developers. Are the suggestions relevant? Are they annoying? Use that to tune your retrieval and presentation.

The Bigger Lesson: AI Should Connect to Organizational Memory

Mishra's biggest takeaway is broader than security. "When enterprise AI agents can build on decisions your organization has already made, rather than just focusing on the current task, their value goes way up."

That's the core insight for ethical sourcing. AI-assisted engineering shouldn't just make developers write code faster. It should help organizations preserve and apply the knowledge they've already accumulated—including their ethical commitments.

Ethical sourcing isn't a one-time checkbox. It's an ongoing discipline. And if we can embed that discipline into the daily workflow of engineers, we're more likely to live up to our promises.

The technology is there. Dropbox has shown it works for security. There's no reason we can't do the same for ethics.