AI-assisted development and agent authority policy

AI-assisted development and agent authority policy

AT-01 — AI-assisted work policy

[Organisation] uses AI assistance within the authority, information handling and verification arrangements recorded for the work. The task owner remains responsible for the intended outcome and for deciding how outputs may be relied upon. AI assistance may support analysis, drafting, implementation, review, testing or operational tasks where that use has been adopted.

The work record identifies the task, permitted scope and relevant requirements. Instructions from the task owner are distinguished from content being analysed, including retrieved documents, source comments, messages and tool output. Information encountered during a task does not itself amend the task’s authority. Where intent is uncertain, the unresolved decision is returned to the person holding it.

AT-02 — Tool registration

The tool owner records the provider, model or service, operating mode, integrations, information destinations and available permissions. Registration includes editor extensions, command tools, connectors and automated workflows through which the tool can act. The record states what is known about provider retention, use of submitted information, subprocessors, version changes and security reporting.

Approval identifies permitted tasks, information categories, environments, actions and conditions. It distinguishes local processing from external service use and identifies the evidence supporting that distinction. The owner records supplier or technical limitations and the authority accepting the resulting exposure. Product settings and service terms are checked for the actual account and configuration in use.

AT-03 — Action authority

The task owner defines the actions available to the tool or its supervising workflow. The record identifies read access, modification, execution, external communication and any ability to change access or publish artefacts. Approval can be specific to an action or established through a bounded standing authority. The boundary states the resources, conditions and decision types included.

Actions outside the recorded authority require the appropriate decision. Tool permissions are configured to support the intended boundary, with any mismatch recorded as a control gap. A prompt describing restrictions is not treated as equivalent to technical enforcement of those restrictions. The owner assesses how indirect instructions, tool responses or retrieved content could cause an authorised component to act for an unauthorised source.

AT-04 — Information handling

The performer checks that information submitted to the AI service is within the approved purpose and handling conditions. Source, logs, prompts, attachments and retrieved context can contain secrets, personal information or confidential material even when the immediate task appears routine. The performer uses the approved information selection or minimisation arrangement and records material limitations.

The tool owner identifies where interaction records, caches and generated outputs are retained and who can access them. Retention and disposal follow the information schedule. The policy does not require keeping sensitive prompt content merely to prove that AI was used; the evidence plan selects the provenance and decision information needed for the relevant assurance claim.

AT-05 — Review generated work

Generated code, configuration, tests and documentation are reviewed against the authorised intent and applicable requirements. The responsible person checks unexplained behaviour changes, invented dependencies, unsupported technical claims and changes to permissions or information flows. The reviewer assesses the actual output and surrounding context, not only the tool’s summary of its own work.

Assertions that a command ran, a build passed, a vulnerability exists or a control is implemented are connected to direct evidence appropriate to the claim. Generated tests are evaluated for the independence and correctness of their expected results. Multiple agreeing AI outputs are not automatically treated as independent evidence where they may share inputs, methods or assumptions.

AT-06 — Execution and supervision

The workflow records material actions and results at the level required by the change and evidence procedures. Records identify the actor or tool identity, task, authority, affected resource and resulting artefact where relevant. The operator can identify when intervention is required and has the means specified in the operating plan to stop or alter the workflow.

The owner defines how incomplete execution, unavailable tools, denied permissions and uncertain results are reported. An action is not described as successful solely because the tool requested it. Unexpected changes or authority violations enter the incident or change-discrepancy process, with the original evidence preserved. Resuming work includes confirming the current state and the remaining authorised scope.

AT-07 — Review and withdrawal

The tool owner reviews the registration when models, providers, connectors, permissions, data use or operating conditions change. Evaluation considers whether the tool still performs the assigned tasks within the intended boundary and whether review remains effective. Findings update the risk record, competence plan and tool configuration.

Withdrawal removes credentials, integrations and retained information according to the applicable arrangements. The owner identifies ongoing outputs or deployed changes that still rely on the tool’s work and retains their review and verification evidence. Ending a subscription does not by itself remove a connector’s access or establish that provider-held information has been disposed of.

AI tool registration: [AT ID; provider; model/service; version visibility]
Owner and purpose: [Tasks; users; environments; approving authority]
Information: [Permitted categories; destinations; retention; provider use]
Actions: [Read/write/execute/communicate; resources; standing authority]
Enforcement and oversight: [Permissions; review; intervention; gaps]
Evidence: [Task; actions; resulting artefacts; verification; limitations]
Review and withdrawal: [Triggers; date; access removal; data disposition]