Half of teams adopted a copilot by decree: someone turns the tool on and the team starts accepting suggestions. With no written policy, each person applies a different review standard, and the tech lead finds out when a pull request full of generated code clears six approvals without anyone reading the logic. An AI pair-programming policy fits on one page, needs four definitions, and works for teams of 5 to 40 people.
Data that never enters a prompt
A written list, with examples, inside the repository. API keys, customer data, code covered by a confidentiality agreement, third-party repos with a restrictive license. The official documentation for generative AI services from AWS and Google Cloud carries its own clauses about data sent to the service, and your policy must state which one governs the company contract. The list lives in the governance repo and in the project README, away from the chat channel.
Human review for every generated change
The author answers for the change. Pull request review keeps the same depth standard when the diff came from the tool. Peng and colleagues, in a study published on arXiv (Microsoft and GitHub, 2023), measured speed gains with GitHub Copilot: the gain shows up in the first write-up of the code, and ownership of the reasoning stays with whoever pushed it. Approving a generated diff without reading it moves the risk into production.
Adoption metric with no ranking
One line per squad in the weekly report. Share of pull requests with accepted suggestions, average review time and defects per release. The DORA State of DevOps Report shows that engineering metrics change behavior when the team discusses the number together, instead of receiving a ranking from above. Two indicators make the cut; if the number turns into theater, drop one.
Consequence set before the incident
The runbook for when banned data goes up. Revoke the credential, notify security, review logs and decide who talks to the customer. Amy Edmondson, in The Fearless Organization (Wiley, 2018), shows that teams who know the response process speak about errors sooner. Defining the consequence upfront takes punishment out of the conversation and keeps the conversation on the cause.
Quarterly policy review
One hour, with the tool, the contract and the team. Remove what nobody follows, add the quarter's new case, and publish a dated version. A policy nobody updates becomes text the team ignores in month two.
