Banning AI-assisted development is the one policy guaranteed to fail — it moves the work onto personal machines and off your telemetry. The defensible position is governance that says yes, like this. This page is the shortest path to holding that position with confidence.
Written for the person who has to answer for it — to the board, to audit, to the incident review.
The mental model: a review problem, not a malware problem. Sets shared language for your staff meeting.
Scope, accountability, audit trail — on one page. Template included; adapt it this week.
Four numbers to report quarterly, and the vanity metrics to retire.
The 90-day rollout plan, the one-page policy, and the twelve questions to put to every AI-tooling vendor — assembled into a working document.