Say yes if any developer uses one, then state the approved tools, what code and data they may access, who administers them, and how AI generated changes are reviewed before merge. Shadow use is common, so answer for what you can show, and say what you are doing about the rest.
What the reviewer is trying to learn
This question is about two risks. The first is data leaving your environment through prompts and context. The second is untrusted code entering your product through suggestions. A good answer addresses both in a few lines.
Reviewers also notice vagueness. "Our engineers use industry standard tools responsibly" tells them nothing. A named list, a policy date and a review rule tell them a lot.
The five facts to state
- Approved tools. List the assistants and editor extensions your policy allows, and say that others are not approved.
- Access scope. Say which repositories the tools can read and whether any are excluded. Private customer data and credentials should be out of scope.
- Administration. Say who manages licences, settings and the allowlist, and whether use is tied to company accounts.
- Review. State that AI assisted changes go through the same pull request review, tests and scans as other code.
- Agent features. If an assistant can run commands or call tools, say what approval it needs.
Sample wording
"Yes. Developers may use assistants from our approved list, administered through company accounts. Repositories holding customer data and credential files are excluded from assistant context. AI assisted changes follow the same pull request review, automated testing and dependency scanning as all other changes. Agent features that run commands require per action approval. The policy is reviewed twice a year; the current version is dated 1 October 2026."
Replace each sentence with your own facts. If you do not exclude any repositories yet, do not claim you do. Write "exclusions are planned for Q1" with a real owner instead.
Handling the shadow use problem
Most teams have some unapproved use. You do not have to confess it in the questionnaire, but you should not deny it either. A defensible position is: "Our policy prohibits unapproved tools. We detect extension installs and review package manifests for AI related dependencies, and we treat exceptions through a documented process." Only write that if it is true.
A practical way to make it true is to publish the allowlist, make the approved route easy, and review the list of installed extensions on a schedule. Related reading: what to approve on an AI coding assistant allowlist and an exceptions process for the policy.
Attach evidence, not adjectives
Offer the policy PDF, the allowlist with dates, and a sample pull request showing the review gate. Evidence shortens the thread. If a reviewer asks for something you do not have, use a plain gap statement instead of stretching.
Safeguard supports the review gate part: policies, gates and guardrails on pull requests, reachability analysis and dependency scanning, and compliance and evidence automation to keep the records.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how a failing check blocks the merge, which is the kind of evidence a reviewer wants to see.
Quick check
Do we have to list every tool?
List every approved tool. If the policy covers a category, such as editor assistants from an allowlist, say that and attach the list.
Is "all code is reviewed" enough?
It helps, but add that AI assisted changes get the same tests and scans. Reviewers want to know the gate does not depend on the author being human.
Last reviewed: 19 October 2026.
