§ 1Most AI coding policies fail for one of two reasons: they are forty pages long, or they say “no”. The forty-page ones never get read; the “no” ones get routed around within a sprint. A policy that works fits on one page and says yes, like this.
The one-pager has three sections. Scope names the tools that are approved and the classes of code they may touch. Accountability states that the human who merges is the author of record — no exceptions, no “the AI did it”. Audit trail requires the assistant’s involvement declared in the commit trailer, and a recorded human review before any protected branch.
What the board actually signs
Boards don’t sign controls; they sign risk positions. The page you put in front of them should open with a single sentence: “We permit AI-assisted development under recorded human review, because prohibition moves the work off our telemetry.” Everything after that is implementation detail.
The template
The full template — with the twelve vendor questions and the 90-day rollout that operationalises it — is assembled in the Field Guide. Adapt the language, keep the structure, and get it signed before the quarter closes.