An unwritten AI policy is still a policy — it just gets written by whoever pastes first. This module authors the real one: data boundaries and approved tools, review standards for AI-generated code with CI enforcement, a graduated autonomy ladder for agents, AI incidents as a first-class category, and the client-approval workflows services leaders live or die by.
Anand runs a 45-person account team at an Indian IT services major, delivering for a US bank whose master services agreement is explicit: no client code or data in public AI tools. His own company, meanwhile, mandates AI adoption in every account — margin depends on it. Anand held the contradiction the way most delivery managers do: quietly, hoping it would resolve itself.
It resolved itself on a Thursday. A well-meaning senior engineer, debugging a gnarly stored-procedure issue at 9 p.m., pasted three hundred lines of the bank's proprietary code into his personal chatbot account. It worked — the bug was found in minutes. He mentioned it in standup as a win. Anand's tech lead went pale, and by the following week the question had traveled from the delivery-excellence team to legal: which tool, which tier, what retention, was the account's code now in someone's training data? Anand could not answer any of it. There was no approved-tool list, no data-classification rule, no disclosure norm — nothing the engineer had violated, because nothing had been written. The client's audit clause meant the bank could ask the same questions any time, and the honest answer was "we don't know."
Nobody in this story is a villain. The engineer was trying to ship; the company mandate said use AI; the contract said don't. The failure is structural: a policy vacuum in exactly the place where two enforceable obligations collide. Governance is how a leader closes that vacuum before the 9 p.m. paste — and this module is the complete governance stack, from usage policy to agent autonomy.
McKinsey's State of AI research finds 51% of firms have already experienced AI-related incidents, and its high performers share two habits: human-in-the-loop rules and centralized oversight with executive accountability. Public templates aligned to NIST AI RMF and ISO/IEC 42001 give you scaffolding; the engineering-specific tailoring is your work. A usable team policy needs exactly six sections — short enough to be read, specific enough to be enforced.
Red-team the draft before publishing: walk five or six realistic violation scenarios through it — the 9 p.m. paste, an agent auto-merging, a contractor on a personal account — and check the policy gives a clear verdict for each. Lab 4 does this against a two-client services scenario with conflicting terms, which is Anand's world with the traps labeled.
Keep the whole document under four pages, and version it like code — reviewed changes, a changelog, an owner. A policy nobody reads is indistinguishable from no policy, and the tooling landscape shifts fast enough that an unmaintained policy is wrong within two quarters. The exception log doubles as your revision signal: three similar exceptions in a month means the policy, not the people, needs the change.
Above the policy sits the org AI stance — DORA's first capability, one page: why we use AI, where we don't, how we measure, and what we promise the team, explicitly including no stealth performance-weaponization of usage data. Ambiguity is not neutral; it breeds shadow AI and fear simultaneously. Which is why discovered shadow use gets amnesty framing — an anonymous survey plus a SaaS-spend scan, positioned honestly as "help us write rules that work" — because hidden usage converted into policy input is a win, and hidden usage driven deeper underground is a breach in waiting.
Policy earns trust only when the org stance keeps its promises — the day usage telemetry shows up in a performance conversation, every engineer learns the policy is a surveillance instrument, and the shadow usage you amnestied comes back for good.
Coinbase runs at roughly 40% AI-generated daily code — with mandatory human review and an explicit ban the industry has memorized: no vibe coding in financial systems. That pairing, volume plus discipline, is the target state. Meanwhile Stack Overflow's 2025 data explains why the discipline is hard: 66% of developers cite "almost right" AI code as their top frustration. Human review is now the bottleneck and the safety net at once, so design it deliberately:
Then enforce by machine, because CI enforcement beats goodwill — every policy line that can become a pipeline gate, should: secrets scanning (Gitleaks/TruffleHog-class) for what gets pasted and committed, license and provenance scanning for what generation drags in, dependency-hallucination checks against known-bad and nonexistent packages — a documented, exploited attack surface — and the coverage floors wired to the provenance labels. A policy PDF asks people to remember rules under deadline pressure; a red pipeline remembers for them. Lab 5 has you apply your standards to three AI-generated PRs, one seeded with a hallucinated dependency and a plausible-but-wrong edge-case branch that generic review misses.
Coding agents raise the stakes from "what may enter a prompt" to "what may the software do" — and autonomy must be a written, earned, revocable setting, never a drift. The instrument is a graduated ladder:
The agent proposes code, or opens branch-isolated PRs that CI verifies and humans merge. No direct write path to anything shared. This is where every agent starts, regardless of vendor claims.
Allowlisted actions execute after a human approves each one. The allowlist is reviewed like code; the approval is logged.
Autonomous action in isolated environments, then — for low-risk scopes only — autonomy inside a pre-declared boundary enforced in code. High-risk paths (payments, auth, prod data) are rung-capped permanently: no promotion path exists.
Around the ladder sit operational guardrails, because an agent is effectively a new kind of teammate with superhuman speed and zero judgment: scoped credentials under the agent's own identity — never a human's borrowed token — audit logging of every action, sandbox and branch isolation, spend caps, and a named kill-switch owner reachable at 2 a.m. If you cannot answer "who can stop this agent right now," the answer is nobody. McKinsey finds 62% of enterprises experimenting with agents and 23% scaling; the scalers are distinguished by exactly these human-in-the-loop rules with executive accountability. Lab 6 has you rule on a promotion request that fails your own criteria — writing the denial memo is the graded act, because saying no to an enthusiastic team, with reasons, is the actual job.
Three governance surfaces complete the stack.
AI incidents as a first-class category. Extend the incident taxonomy: AI-caused outage, data leakage via prompt (Anand's Thursday), agent action gone wrong. Each gets severity mapping, comms templates, and blameless-but-accountable review — blameless toward the person, accountable about the control gap. With 51% of firms reporting AI incidents while almost none have an AI-incident runbook, writing one is cheap insurance you will probably use.
Client-approval workflows. For services and GCC leaders, the policy must resolve per-client:
| Client posture | What the team may use | Evidence you maintain |
|---|---|---|
| No AI on client code | Approved tools for internal work only; client work is a no-AI zone | The boundary rule, onboarding acknowledgment, audit trail |
| Enterprise-tier with no-training clause | Named tools on documented tiers | Vendor DPAs, no-training terms, usage attestation |
| Client-tenant tools only | Client-provided Copilot-class instances | Client's own admin logs; your access records |
| Silent contract | Default no; proposed MSA/SOW AI addendum | The addendum draft and approval correspondence |
Legal and IP literacy. You need leader-grade literacy, not lawyering: license contamination in generated output, unsettled copyright status of AI-generated code, vendor indemnification differences (the major coding-tool vendors now compete on indemnity terms), and no-training and data-residency clauses to require — DPDP in India and GDPR in Europe both flow into the policy. Then the rule that keeps literacy honest: legal review is a mandatory gate for anything client- or IP-touching. Your briefing prepares the conversation; it never replaces it.
The expensive version of governance is the retroactive one — written after the client audit letter arrives, under legal supervision, with a breach notification attached. Every section in this module costs less before the incident than after it.
Governance is a stack, and every layer is enforced, not hoped: a six-section usage policy red-teamed before publishing, review standards where the author explains every line and CI carries the rules, an autonomy ladder where agents earn each rung and lose them automatically, and per-client boundaries with legal review as a real gate. Write it before the 9 p.m. paste — after costs more.