Agree the rules together.
Without shared norms, every person makes up their own, and the gaps are where the risk lives. Four questions cover most of it.
Where it's welcome
Go Ahead
- Drafts, tests, refactoring, research
- Which tools are approved
Where it needs a check
Use, Then Verify
- Production code, config, customer copy
- Who checks, and how (Day 25)
Where it's off-limits
Don't
- Customer PII in public tools (POPIA)
- Final calls on people or security
How we disclose
Be Open
- “AI-assisted” noted in PRs and docs
- No shame, just context for reviewers
Source: POPIA ↗
Agree it together. Write it down.