A short course every team member takes — how we use AI to do better work, safely, and the policies we all follow.
Use AI freely to do better work.
But a human owns every output,
and client & confidential data
never touches an unapproved tool.
We use AI to speed up routine, data-heavy work
— and to amplify what people can do.
AI is a tool. It doesn't remove responsibility, and it never makes the final decision instead of a person.
Before we build or ship anything that uses AI, we define what harm it could cause if things go wrong. The higher the risk, the more carefully we handle it — no skipping steps under pressure.
Internal helpers, drafts, tools that don't affect clients or money.
Features clients see, and that influence their decisions.
Anything touching money, safety, legal rights, large volumes of personal data, or many people at once.
The next three slides break each level down — examples plus how to use AI.
Internal helpers and drafts that don't affect clients or money.
Green light — use AI freely. Standard review is enough; just don't paste anything sensitive.
Things clients see, and that influence their decisions.
Use, then verify — a human reviews everything before it reaches a client. Check facts, tone, and edge cases.
Money, safety, legal rights, bulk personal data, or many people at once.
AI assists, it never decides — mandatory expert review, extra testing, approved tools only. When in doubt, don't.
A person with the right knowledge and authority makes the final call and signs off. Whoever ships the system owns the results — including what happens next.
We don't take AI output on faith. Run and review the code, check the facts, confirm packages and sources exist. On medium and high risk, test how it behaves in unusual and adversarial conditions.
The one rule we never bend. Personal data, client secrets, and our own confidential information are protected by default: collect only what's needed, use it only for the stated purpose, and never send it to tools that can't guarantee the same protection.
Secrets and powerful capabilities are closed by default. Access is opened deliberately, temporarily, and only for the specific task. Agents and tools run with the smallest set of permissions possible.
AI-produced code, text, analysis, or decisions go through the same reviews, tests, and security checks as if a person wrote them. On high risk the bar is higher — and we keep watching behaviour after release.
Anything you send to a public AI tool may be retained, logged, or used for training. Only approved tools with clear no-training and zero-retention terms are treated differently. When in doubt, treat it as public.
Right now we use personal accounts (including paid ones). We treat them as public tools and use them with Public data only. For Confidential or Restricted data, don't use AI tools without additional approval.
A five-second gut check before you paste anything. Work top to bottom — the first match wins.
.env?Already public — no harm if it's seen.
Any approved tool is fine.
Generic, non-sensitive material that stays inside the company.
Approved business-tier tools, training off — not free tiers that train on inputs.
Proprietary to us — real damage if it leaks.
Approved enterprise tools only, minimized and redacted.
The hard line — never goes to an unapproved tool.
.envNo AI unless the client approved the specific tool in writing.
.env filesgitleaksStop using that chat, don't continue the conversation, and follow the incident process — see Module 06 · When things go wrong.
| Category | Examples | Status |
|---|---|---|
| Coding assistants (business tier) | Claude / Claude Code, Copilot, Cursor | Recommended |
| Chat assistants (enterprise) | Claude Team/Enterprise, ChatGPT Team | Recommended |
| Free consumer tiers | Free chatbots, browser add-ons | Public data only |
| Unvetted tools / MCP servers | Unknown plugins, "free GPT" sites | Avoid |
| Any tool on Restricted data | — | Needs written OK |
The best safety rules are the ones the tool enforces. We put guardrails into the dev environment, committed to the repo, so every engineer and every AI session inherits them automatically.
Declaratively block the AI from reading sensitive files — .env, keys, secrets/**.
Stop risky actions before they run, and scan changes for secrets after they're made.
// .claude/settings.json
"permissions": {
"deny": ["Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)"]
}The AI can't read or print .env files, keys, tokens, or secret folders.
No rm -rf on important directories, no force-push to main, no overwriting critical config.
After the AI writes code, we scan for secrets (e.g. gitleaks). If something is found, the change is stopped.
Agents and tools only get the permissions they actually need for the task. Everything else stays closed.
Prevent the AI from sending sensitive data to external services unless it's explicitly allowed.
A secret scanner reads your diff for things that look like keys, tokens, and credentials — and stops them reaching git history. Run it at more than one layer.
Blocks the commit locally if a secret pattern is found — the earliest, cheapest catch.
A pipeline job re-scans every push, so nothing slips through a skipped local hook.
A PostToolUse hook runs the scanner right after the model writes code.
AI writes the first draft.
You are the engineer.
The moment you commit it, it's your code. It carries the same responsibility, the same review, and the same standard as if you had written every line yourself.
AI can sound confident even when it's wrong. Review with that in mind.
Once a secret reaches a remote system, a log, or any external tool (including AI), treat it as compromised — assume it was copied almost immediately. Deleting the file or rewriting git history does not make it safe again. You must rotate it. Cleanup only stops further exposure.
Disable or tightly scope the credential right away; revoke active sessions if you can.
Create the new secret first, deploy it, then revoke the old one — don't take prod down.
Check provider audit logs & billing for unauthorized use. If it was a client's, involve the right people early.
Remove it from code, logs, and chat history. Rewriting git history (filter-repo / BFG + force-push) is sometimes needed — do it carefully and coordinate.
Tell your lead or security contact promptly. Not a blame event — fast reporting beats perfection.
Strengthen the basics: .gitignore, secret scanning, deny-lists + hooks, a proper secret manager.
Pasted a secret into ChatGPT, Claude, Cursor, or similar? Treat it exactly like a public leak.
.env files into any AI tool