Apply the same AI coding rules to contractors and agencies by writing them into the contract, requiring disclosure of the tools used, limiting repository access, and reviewing their pull requests as you would anyone's. You cannot see their laptops, so rely on contract terms, access control and review.
Why contractors need a clause
Your policy binds employees. A contractor may use personal accounts, free tiers or tools you have never evaluated, and may paste your code into them without realizing it matters. If the contract is silent, you have no basis to object later.
What to put in the contract
| Clause | Purpose |
|---|---|
| Approved tools or approval process | Names what they may use with your code |
| Disclosure | They tell you which assistants are used |
| Data restrictions | No customer data or secrets in any assistant |
| Account type | Business accounts with terms that suit your data |
| Ownership and licensing | Clear rights to delivered code |
| Incident notice | They report suspected exposure promptly |
| Right to review | You can ask about practices and request evidence |
Have your legal team review the wording. The table is a list of topics, not legal text.
Technical controls you hold
- Scoped access. Give contractors access to the repositories they need and nothing else.
- Their own identities. Named accounts, removed at contract end.
- Pull request only. No direct pushes to protected branches.
- Required review. Use CODEOWNERS for sensitive paths so a staff member approves.
- Standard checks. The same scans and tests as employees.
- No production secrets. Use test environments and short-lived credentials.
Review without distrust
Ask for a short written description of the tools and settings used. Compare it with your own list. Sample a few pull requests for patterns that suggest unreviewed generated code: large diffs with no tests, unfamiliar dependencies, inconsistent style. Treat findings as a conversation first.
At the end of the contract
Remove access, revoke tokens, and ask them to confirm that your code and data are deleted from their tools and accounts. Keep the confirmation.
Quick check
Can we ban contractors from using AI assistants?
You can, by contract. Enforcement relies on access limits and review, since you cannot monitor their devices.
Do we need disclosure if they use only autocomplete?
Yes, ask anyway. Autocomplete still sends code context to a service.
Safeguard offers policies and gates for pull requests and asset discovery to help you see what is in your estate. Try a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
