AI_CODING_POLICY.md sets the team baseline
AI_CODING_POLICY.md is a short team agreement for using Claude Code safely. It does not replace detailed RISK_CLASSIFICATION.md, QUALITY_GATES.md, or the Production Decision Gate. Its purpose is to remove inconsistent interpretations of allowed, controlled, and prohibited actions.
The policy should be short enough for daily use and specific enough to make clear when review or explicit human approval is required.
| Category | Examples |
|---|---|
| Allowed | Analysis, code explanations, documentation drafts, PR notes, local refactoring with tests |
| Review required | Feature code, config, dependencies, shared hooks/plugins, write-capable MCP, public API |
| Human approval | Production deploy, destructive DB actions, force push, IAM, secrets, shared infrastructure |
What the policy should cover
- AI-use categories and permitted permission modes;
- constraints for secrets, personal data, and customer data;
- PR requirements and attribution of AI assistance;
- approval rules for plugins and MCP;
- CI/CD automation boundaries and branch protection;
- permitted environments for experiments: branch, worktree, staging;
- human responsibility for merge and release.
The policy needs technical enforcement
A document alone does not block a dangerous action. Strengthen the team baseline with session permissions, team-level settings, hooks, protected paths, branch protection, and a reference from CLAUDE.md.
For example, force push and editing .env can be blocked, while publishing a package or changing payment code can require explicit approval.
- the policy text explains expected behavior;
- permissions and hooks enforce the technical boundary;
- quality gates check the outcome;
- a human owner makes the final decision.
How to update the policy from process signals
Update the policy in response to recurring team problems, not a single mistake. Put team changes through a PR and short changelog so it is clear why the rule was added.
| Recurring problem | Where to improve |
|---|---|
| AI notes missing from PRs | PR template and policy |
| False positive from a reviewer-agent | SKILL.md or agent configuration |
| Force push or protected-path access | Policy, permissions, and hooks |
| Failed shared workflow asset | README, changelog, and rollout rules |
Policy readiness review
- is it unambiguous what is allowed without additional approval;
- are the actions requiring review named;
- is it clear what cannot happen without human approval;
- are prohibited data and environments described;
- are the checks before merge specified;
- is the person responsible for the final decision named;
- are the technical mechanisms enforcing the policy known.
Canonical lesson source · JavaRush
Open JavaRush material