An AI coding policy for teams: what to include
By the AgentReceipt team · Updated 13 November 2026
A policy does not need to be long. It needs to answer the questions people will otherwise answer differently each time.
Where agents may be used
Say which agents are approved, on which repositories, and for which kinds of work. Name the areas where agents are not to be used without sign-off.
What needs review
State that agent-written changes get the same review as any other, with extra attention to tests, dependencies and sensitive areas.
What must be recorded
Decide what you keep: the prompt, the files changed and any risk found. Decide how long, and who can see it.
Who decides
Name one person or group who owns the policy and the exceptions. A policy with no owner stops being followed.