The rules worth writing down

Most teams already have opinions about where AI-written code is acceptable. The policy file turns those opinions into something a machine can check on every commit.
Book a demo

Protected directories

Name the paths where AI-authored lines need a human reviewer before they can be committed — payment handling, authentication, anything a regulator will ask about first.

  • Per-directory rules
  • Human approval required
  • Warning or block

Allowed tools and models

Keep a list of the agents and models your organisation has assessed. Anything outside it is flagged, so a new tool arriving on a laptop becomes visible rather than silent.

Retention, as archiving

Set how long records are kept. Retention here means archiving rather than deletion, because a record that can be deleted on request is not much of a record.

How it runs

As a command

Check the working tree against the policy and get a readable list of what fails and why.

As a pre-commit hook

The same check before a commit is created, so the feedback arrives while the change is still in your hands.

In CI

An exit code means a pipeline can treat a policy failure like any other failing check.

Warning before blocking

The first version of any policy is wrong somewhere, and a tool that blocks commits on day one gets disabled by the end of the week. The default is to warn and record. Blocking is a flag you turn on per rule once you trust what the rule is telling you.

Write the first rule with us.

Most teams start with one protected directory and a tool allowlist. That alone changes what shows up in the next report.