AI Governance Checklist for Dev Teams: data, secrets, generated code

AI coding tools change what leaves your machine, who can read a prompt, and what ends up in a pull request. This checklist gives a dev team a repeatable answer to “is this safe to paste” and “is this safe to merge,” without reading every vendor’s terms page from scratch. Every data-policy claim below is backed by an official source; anything we couldn’t verify is marked that way instead of guessed.

Data privacy: what leaves the machine

Every AI assistant sends prompts and context to a provider’s servers. The real question is what happens next, and which setting controls that.

That’s a setting problem, not a reason to avoid these tools. The Cursor cheat sheet covers where these controls live day to day.

Secrets: never in prompts, caught before they leave

A training policy is irrelevant if a secret already left your machine in a commit or a pasted log.

Generated-code validation

AI code sounds just as confident wrong as right. Gate it like any other diff, plus one check this source needs.

Hallucination controls

A hallucination is a wrong fact delivered as confidently as a right one. These controls are about where a human re-enters the loop.

Supply chain: MCP servers as third-party code

An MCP server is a program the host launches and trusts with tool access. The protocol doesn’t sandbox it — you do.

Regulations to be aware of

Informational only, not legal advice — check with counsel before making a compliance claim to a client or regulator.

Team policy template

Paste into AI_POLICY.md; adjust tool names and plan tiers to your org’s licenses.

# AI Tool Usage Policy

## Scope
Claude Code, Cursor, GitHub Copilot, ChatGPT — anyone working in this
repo or on client deliverables.

## Approved accounts
- Commercial/Team/Enterprise accounts only for client or production
  work. Personal accounts are for learning and open source only.
- Confirm Privacy Mode / content exclusion / workspace type before
  touching a new client's code or data.

## Never paste
- Credentials, API keys, tokens, kubeconfigs, private keys.
- Client PII: names, emails, account IDs, identifying notes.
- Anything under a .gitignore or Copilot content-exclusion path.

## Generated code
- Ships with a test, passes the existing lint/SAST gate.
- New dependencies verified on the real registry, then pinned.
- A human reviews the diff before merge. No auto-merge.

## MCP servers
- Reviewed for source, permissions, and pinned version before any
  team member connects them.
- Secrets live in the server's own env config, never a shared shell.

## Incidents
- A pasted secret is a leaked credential: rotate it immediately.
- Report a suspected hallucinated dependency, or a merged AI diff
  that broke something, to #eng-incidents the same day.

## Review
Reviewed quarterly as vendor terms change.

Patterns you’ll reuse

• Pre-commit secret scan: pre-commit install && pre-commit run gitleaks --all-files
• Scan full git history: gitleaks git -v --redact
• Skip the hook on purpose: SKIP=gitleaks git commit -m "..."
• Block .env reads in a Claude Code PreToolUse hook (matcher ^Read$): jq -r '.tool_input.file_path' | grep -qE '\.env(\.|$)' && exit 2 || exit 0
• Verify a package exists before installing: npm view <package> or pip index versions <package>
• Pin an MCP server instead of latest: use an exact tag in command/args
• Force “unknown” over a guess: “If a required fact is missing, list it under Unknown. Do not fill it in.”

FAQ

Does Cursor’s Privacy Mode stop my code from being used for training?

With Privacy Mode on, Cursor says your code is not used for training by Cursor or by the AI providers it calls, under zero-data-retention agreements. A few models fall outside that agreement and need separate admin approval. Privacy Mode is off by default for individuals and on by default for Enterprise teams.

Does GitHub Copilot see files I’ve excluded, including in Agent mode?

Repository and organization content exclusion stops excluded paths from reaching inline suggestions and Copilot Chat in the IDE. GitHub’s docs say Copilot CLI and Agent mode in Copilot Chat do not support content exclusion, so treat agent and CLI sessions as unprotected by that control.

Is ChatGPT Team or Enterprise data used to train OpenAI’s models?

By default, OpenAI does not use inputs or outputs from ChatGPT Business, Enterprise, Edu, or the API to train models. An organization can opt in. On personal Free, Plus, or Pro accounts, submitting thumbs-up or thumbs-down feedback can still let OpenAI use that conversation even after a general opt-out.

How does Claude Code’s data policy differ between a personal plan and a Team or Enterprise plan?

On a personal Free, Pro, or Max account, you choose whether chats and coding sessions improve future models. On Team, Enterprise, API, and Claude Gov accounts, Anthropic does not train on your code or prompts unless the organization explicitly opts in, for example through the Development Partner Program.

How do I catch an AI-generated dependency that doesn’t actually exist?

Look the package up on the real registry before installing it. For npm, run npm view <package>; for pip, run pip index versions <package>. A failed lookup means don’t install — a non-existent name is also a slot an attacker can register and ship malware under.