AI in Development
Use AI to improve engineering work without giving up judgment, security, or ownership.
AI can explain unfamiliar code, draft tests, compare options, and automate bounded work. It can also produce confident errors, insecure code, invented facts, and unnecessary content. The engineer using it remains responsible for the result.
Core rule
Treat AI output as an untrusted proposal. Understand it, verify it, and own it before it becomes part of the product.
Team rules
- Use only approved tools for company work.
- Never send secrets, credentials, customer data, or restricted company information to an unapproved model.
- Give the minimum relevant context; state the goal, constraints, and non-goals.
- Keep changes small enough for a human to understand and review.
- Verify claims against code, tests, runtime behavior, and authoritative sources.
- Apply the same security, quality, accessibility, and review standards as human-written work.
- Do not let an agent perform high-impact or irreversible actions without explicit approval.
- Record important assumptions and disclose material AI use when policy, licensing, or review requires it.
- Stop when the model lacks context or evidence. Do not fill gaps with plausible guesses.
- The author and reviewer—not the tool—are accountable for the merged change.
Do and do not
| Do | Do not |
|---|---|
| Ask for options, risks, and evidence | Ask for a large feature and merge the first answer |
| Share narrow, sanitized context | Paste credentials, private data, or an entire repository without need |
| Read every changed line | Approve a diff because it looks polished |
| Run relevant tests and security checks | Treat generated tests as proof by themselves |
| Verify packages, APIs, and citations | Trust invented libraries, versions, or links |
| Keep a human approval step for impact | Give broad production access to an autonomous agent |
| Rewrite vague or repetitive output | Publish low-value generated content to appear complete |
| Preserve uncertainty in the record | Turn an assumption into a confident statement |
Choose the level of control
| Work | Required control |
|---|---|
| Explanation, brainstorming, test ideas | Engineer checks relevance and facts |
| Code, configuration, migrations, dependencies | Engineer reviews the diff and runs targeted checks |
| Authentication, payments, security, customer data | Domain review, threat-aware tests, and explicit approval |
| Production, deletion, privilege, or external communication | Human approval at the action boundary and a recovery plan |
Learning path
1 · Daily workflowAI-assisted workUse AI for exploration and implementation without replacing engineering judgment.2 · QualityContext and reviewGive useful context, catch confident errors, and prevent low-value output.3 · ResponsibilitySecurity and ethicsProtect data, verify generated code, and consider people affected by the work.4 · AutomationAgentic engineeringGive agents bounded tools, permissions, approvals, and observable stop conditions.