# AI Coding Assistant Rollout Checklist

Use this before rolling out Codex, Claude Code, GitHub Copilot, Cursor, Antigravity CLI, or similar tools.

## Policy

- Define approved tools and blocked tools.
- Define what code, secrets, customer data, and incident data may be shared.
- Define when AI output requires human review.
- Define who owns exceptions.

## Repository Controls

- Require pull requests for AI-generated changes.
- Require code owner review for sensitive paths.
- Enable secret scanning and push protection.
- Enable dependency review and code scanning.
- Block direct pushes to protected branches.

## Agent Controls

- Prefer branches and disposable workspaces.
- Log prompts, diffs, commands, and test results.
- Keep production credentials out of coding-agent sessions.
- Require approval before deploy, destructive commands, or broad rewrites.

## Developer Enablement

- Give developers approved prompt patterns.
- Provide secure-code review rubrics.
- Teach how to verify AI output with tests and source evidence.
- Track false positives, escaped bugs, and productivity outcomes.

## Governance

- Review usage monthly.
- Audit high-risk sessions.
- Rotate exposed tokens immediately.
- Retire tools or plugins that cannot meet logging and access requirements.