AI Project Policy

Appearance

Policy Principles ​

1. Exploration is encouraged ​

AI is moving quickly. The best way to understand it is to use it.

Employees are encouraged to:

  • try prompts;
  • test tools;
  • build small demos;
  • compare models;
  • use AI to support normal work;
  • explore ideas before they become formal projects;
  • share useful patterns with other teams.

Curiosity, experimentation, and learning are welcome.

The expectation is that experiments use approved environments and appropriate data.

2. Dev is available early ​

You do not need to wait until an idea is complete before asking for help.

Dev is happy to consult on:

  • ideas and approaches;
  • model choices;
  • tools;
  • AI-compatible search and fetch;
  • vector databases;
  • prototype design;
  • product specifications.

If you have an idea but do not know how to prototype it, Dev can help turn it into a product specification.

3. Useful ideas should have a path to become real systems ​

Some experiments will stay small. Others may become real tools, workflows, or product features.

That is a good result.

When an AI idea starts to become important to real company work, it should be handed off to the domain specialists responsible for the affected systems and risks.

The original team should continue to provide the product idea and business context. The specialist teams provide the ownership needed for:

  • production quality;
  • security;
  • reliability;
  • data handling;
  • infrastructure;
  • monitoring and incident response;
  • access and long-term support.

The handoff helps the idea meet the same standards as other company systems.

4. Production use needs accountable ownership ​

An AI experiment needs handoff when it starts to access or affect real company operations.

This includes:

  • production systems;
  • customer data;
  • employee data;
  • secrets or passwords;
  • company-sensitive data;
  • workflows that affect customers, employees, money, security, or operations.

At that point, it is no longer only an experiment. It needs ownership from the accountable company team or teams for the affected domain.

5. Dev owns the technical safety rules ​

Dev defines the technical rules for this policy.

This includes SRE and DevOps topics such as:

  • production access;
  • infrastructure;
  • security review;
  • secrets handling;
  • monitoring and alerts;
  • incident response;
  • rollback plans;
  • use of company AI inference resources;
  • approval for stronger or more specialized model access.

Other teams may also need to review some use cases. For example: legal, compliance, privacy, HR, procurement, or finance.

Dev will route requests to those teams when their review is required.

6. Use company AI resources when possible ​

The company provides AI inference resources for experiments and projects.

Use these company resources when possible. They let people experiment while keeping access, capacity, and security manageable.

The company supports many inference options, from top-tier premium models to small open-weight models. Bring the problem to Dev. Dev will help identify the right solution.

If you need a top-tier model, high quota, special model, new vendor, search, fetch, or vector database support, request it through Dev's normal request or ticketing process. Provide enough context to explain the problem. If a follow-up is needed, Dev will schedule one.

7. Sensitive data needs stronger controls ​

Use the least sensitive data that can answer your question.

Good experiment data:

  1. synthetic data;
  2. public data;
  3. approved non-sensitive internal data.

Sensitive data should be used only after the use case has been handed off and approved by the responsible team.

This protects customers, employees, the company, and the person doing the experiment.

8. AI output requires review before real-world impact ​

AI can be very useful. It can also be wrong.

Sometimes AI output sounds confident even when it is wrong.

For systems under Dev authority, a person must review AI output before it affects:

  • security;
  • production systems;
  • infrastructure;
  • access control;
  • incident response;
  • important operational decisions.

For HR, legal, compliance, finance, customer eligibility, or similar business workflows, involve the responsible business owner and required specialist teams.

Human review helps us use AI with confidence.