Most AI coding policies are two pages of principles nobody can check. A shorter policy that a machine can evaluate on every commit is worth more than a thorough one that lives in a wiki.
Six clauses cover the ground.
1. Approved tools and models
Name the agents your organisation has assessed, and say what happens when something else appears. Keep it as a list rather than a principle, because a list can be checked. Expect it to change monthly.
2. Protected directories
Name the paths where AI-authored code requires explicit human sign-off. Payments, authentication, anything safety-related, anything a regulator opens first. Keeping this list short is what makes it survive.
3. Recording
State that AI-assisted development on production repositories is recorded, and where the record lives. This is the clause that makes the others enforceable — without it, every other rule relies on self-reporting.
4. Secrets
Say plainly that credentials must not be pasted into prompts, and back it with tooling that strips them before anything is written. A rule with no mechanism behind it is a hope.
5. Retention
Say how long records are kept and that retention means archiving rather than deletion. A record that can be deleted on request is weak evidence precisely when it matters.
6. Review expectations
Say what reviewing AI-generated code means in your organisation. “The reviewer must be able to explain what the change does” is checkable in a conversation. “Reviewers should exercise appropriate care” is not.
Put it in the repository
A policy that lives next to the code changes through review like the code does, travels with a fork, and can be evaluated by a pre-commit hook. A policy that lives in a document management system is read once, at induction.
Start in warning mode. The first version of any policy is wrong somewhere, and finding that out through warnings is much cheaper than finding it out through blocked commits.