Version: 2026-06-05
Summary
- AI use should not be decided privately by every developer.
- The team needs a visible AI tool list with simple categories.
- Project lead and technical lead decide tool approval; critical tools need security or maintainer review.
- External contributors must discuss their AI use before project work.
- Project-specific AI rules belong in the repository.
- New tools should be classified; unplanned use must be classified afterwards.
- AI safety needs regular maintenance time.
- Few rules applied consistently are better than perfect rules nobody follows.
Topic
Team-wide governance of AI use: allowed tools, approvals, external contributors, rule state, exceptions, reviews, and responsibility.
Starting Point
AI adoption often starts individually. One developer uses a cloud assistant, another uses a local model, a third uses an IDE agent, and external contributors bring their own setup.
This is manageable only while no customer data, project code, external systems, or shared deployment paths are affected. In real project work, that boundary is crossed quickly.
Risk
If every person uses AI differently, the team cannot know which data was exposed, which tools affected code, which rules applied, or which output needs additional review.
Recommendation
Keep governance lightweight but visible. Maintain a small list of approved, restricted, experimental, and forbidden tools. Put project AI rules in the repository. Define who approves tools and who reviews exceptions.
External contributors follow the same rules as the team. If they use their own tools, the project still needs to know what those tools can see and do.
Review Checklist
- Is there a visible tool list?
- Are tool categories simple and understandable?
- Do project rules live in the repository?
- Are external contributors covered?
- Are deviations documented?
- Is there time allocated to keep rules current?
Wall rules
One team, one rule set: AI use must be visible and coordinated.
Few rules, consistently applied.
If it is not documented, it is not a team rule.
External contributors follow the same AI rule set as the team.
Safety does not happen on the side: AI rules need maintenance time.
Open questions for a project
- Which tools are approved, restricted, experimental, or forbidden?
- Who approves new tools?
- How are external contributors onboarded?
- How often is the rule set reviewed?