AI Project Policy

Appearance

Definitions ​

AI tool ​

Any software, service, model, assistant, agent, API, plugin, or workflow that uses machine learning or generative AI to produce, transform, summarize, classify, decide, recommend, retrieve, or act on information.

See Decision Guide: AI Tool vs AI Feature for the practical difference between using an AI tool, building an AI prototype, and creating an AI feature or managed tool.

Experiment ​

A short-lived or exploratory use of AI intended to learn, validate feasibility, compare approaches, or improve personal/team productivity without accessing production systems, sensitive data, or customer-impacting workflows.

Prototype ​

A more structured experiment that demonstrates a possible workflow or feature. A prototype may have code, prompts, integrations, or a user interface, but it remains non-production until it is handed off and approved for production use.

Production system ​

Any system, service, environment, workflow, data store, account, API, network, queue, integration, or automation that supports live business operations, customers, employees, vendors, financial processes, security operations, or regulated obligations.

Sensitive data ​

Data that requires protection due to customer trust, company policy, security risk, contractual obligation, legal/regulatory exposure, or business confidentiality.

For this policy, sensitive data includes at minimum:

  • customer data;
  • employee data;
  • credentials, tokens, API keys, passwords, certificates, session cookies, or secrets;
  • production logs containing identifiers or operational details;
  • source code from private repositories where disclosure would create security or IP risk;
  • security findings, vulnerabilities, incident details, or threat intelligence;
  • financial data;
  • legal, compliance, audit, or regulatory material;
  • vendor-confidential or partner-confidential information;
  • internal strategy, unreleased product plans, pricing, or other company-confidential information.

See Decision Guide: Data Sensitivity for practical examples.

Dev may route requests to legal, compliance, privacy, or HR when the data type requires their review.

Company inference resources ​

Company-managed AI inference infrastructure, subscriptions, gateways, APIs, hosted models, or vendor-backed services made available for employee experimentation or approved project use under company access, cost, logging, and security controls.

Company inference access ​

Access to company-supported AI inference resources for experimentation or approved project work. The company supports a wide range of inference options, from top-tier premium models to small open-weight models.

Specialized model access ​

Access to models, vendors, quotas, context windows, modalities, agents, tools, or throughput that require additional review because of cost, security, operational, or vendor impact. This includes top-tier models, high-cost inference, specialized reasoning models, production-grade quotas, or access patterns that materially increase security, cost, operational, or vendor risk.

Accountable owning team ​

The team responsible for the production lifecycle of an AI capability. This includes the areas that team normally owns, such as architecture, implementation, access control, monitoring, incident response, maintenance, rollback, and decommissioning.

Human-in-the-loop ​

A control pattern where a qualified person reviews, approves, corrects, or rejects AI output before it affects a production system, customer, employee, financial process, security action, or other material business decision.