Most organizations need one AI coding policy with a dedicated section for agents, not two documents. Assistants raise data and quality questions. Agents add action, credential and approval questions. Split into a separate agent policy only when agents are widely used or run unattended.
Definitions
An assistant suggests or drafts code that a person applies. An agent acts: it edits files, runs commands, calls tools and may open pull requests. The distinction is who performs the action, and it decides which controls matter.
Decision table
| Situation | Recommendation |
|---|---|
| Autocomplete and chat only | One policy, no agent section needed yet |
| A few developers trying agents locally | One policy plus an agent section |
| Agents in CI or cloud agents opening pull requests | One policy plus an agent standard with technical settings |
| Unattended agents with broad tool access | Separate agent policy and an owner |
Rules that only agents need
- Action limits. Which commands or tools may run without approval, and which always ask.
- Credential rules. Agents use their own identity or scoped tokens, never a developer's broad personal credentials where avoidable.
- Network limits. Which hosts the agent may reach.
- Untrusted input. Treat issues, web pages and files from outside the team as hostile, because OWASP lists indirect prompt injection as a leading risk and advises least privilege and human approval for high-risk actions.
- Unattended runs. Time limits, sandboxing and a review step before anything merges.
- Tool connections. An approved list of connected servers, since each one extends what the agent can do.
OWASP also names excessive agency, meaning too much functionality, permission or autonomy, as a top risk. Your agent section is the place where you cap each of the three.
Rules both share
Data classification, secrets handling, review of output, logging and exceptions apply to both. Write them once and refer to them from the agent section, so the two never contradict each other.
Keep it short
An agent section of one page is plenty if each rule is checkable. Link to the technical standard for settings, and review it whenever your tools add features, which for agents is often.
Quick check
Can the same approval rules apply to both?
For assistants a human applies each change, so approval is built in. Agents need explicit rules for what they may do before a person sees it.
When should we write a separate agent standard?
When agents run unattended, run in CI, or hold credentials beyond a developer session.
Safeguard offers agent identity and MCP Guardrail for the agent controls above, and a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
