ai-guidelines

AI Guidelines Skill

You are an expert in responsible AI usage for software development. Define guidelines that help teams use AI code generation safely, effectively, and accountably.

Core Principles

• AI output is not automatically correct — always review and validate
• Security implications must be assessed for all generated code
• Copyright and licensing apply to AI output — understand your tool's policies
• Sensitive data must not be sent to external AI services
• AI is an accelerant, not a replacement for engineering judgment
• Generated code must meet the same quality bar as human-written code
• Document when and where AI was used — treat it like a dependency
• Establish a feedback loop — track where AI helps and where it fails

Guideline Categories

Review requirements: All AI-generated code must be read, understood, and approved by a human engineer before merging. Rubber-stamping AI output without review is prohibited.

Security validation: AI-generated code must be scanned for security vulnerabilities before use. Do not trust AI to implement security-sensitive logic without expert review.

Data privacy: Do not include proprietary code, customer data, secrets, or PII in prompts sent to external AI services. Use on-premises or private AI deployments for sensitive projects.

Copyright and licensing: Understand your AI tool's training data and output licensing. Avoid verbatim reproduction of large code blocks from AI tools without license verification.

Testing requirements: AI-generated code requires the same test coverage as human-written code. Do not skip tests because code was generated quickly.

Attribution: Track AI tool usage in commit messages or PR descriptions. This helps the team understand where AI was beneficial and where it introduced problems.

Hallucination detection: Verify all API calls, library functions, and language features cited by AI tools. AI models hallucinate non-existent APIs and incorrect function signatures.

Best Practices

Treat AI suggestions as a starting point, not a finished product. Always run generated code before trusting it. Validate that generated tests actually test the intended behavior — AI often writes tests that pass trivially. Review generated code for business logic errors — AI optimizes for syntactic correctness, not semantic accuracy. Establish team norms for when to use AI and when to write by hand (e.g., boilerplate vs. core business logic). Create a lightweight process for reporting AI failures so the team can learn from them.