A small team needs six written facts: the AI tools in use, the data that must not go into them, the review rule for AI assisted code, how access is managed, what is logged, and who owns the policy. Written in a page, these answer most AI questions without a program.
Start from what you can keep up
Big company answers describe committees and tooling. A team of ten should not copy them. A reviewer would rather read a short true page than a long aspirational one. The goal is a small set of answers you will still be true next quarter.
The six facts
1. Tools in use. Make a list of assistants, extensions and MCP servers. If you do not know, ask the team and write what you hear, with a date.
2. Data rules. One paragraph: never paste credentials, customer data or private keys into an assistant. Say which repositories, if any, are excluded from assistant context.
3. Review rule. AI assisted code goes through the same pull request review and automated checks. That rule needs no new process.
4. Access. Company accounts only, single sign on where available, and removal at offboarding. Include MCP configs and tokens in the offboarding checklist. See offboarding AI assistants and MCP configs.
5. Logging. Say what you have. Even "tool vendor logs plus our pull request history" is a legitimate, specific answer.
6. Owner. One named person, a review date, and a rule that new tools need a quick approval from them.
A one page template
| Section | One line |
|---|---|
| Scope | Tools covered |
| Allowed | Approved list and how to request more |
| Not allowed | Data and actions off limits |
| Review | Pull request rule |
| Access | Accounts, sign on, offboarding |
| Records | What is logged, where |
| Owner | Name and review date |
What to leave out
Do not describe controls you plan but have not built, unless you label them as plans with dates. Do not claim a certification you do not hold, and do not use SOC 2 language unless an audit report exists. If one is in progress, say "in progress" and nothing more.
Grow when the questions grow
Add an MCP server register when your count passes a handful. Add token scoping when agents begin to write to systems. Add an approval step when agents can change production. The MCP guidance on scope minimization and local server consent gives you a short list of what to add next. Related: answering questionnaires before your SOC 2 Type 1 arrives.
Where tooling helps
Safeguard offers a free scan at gold.safeguard.sh/scan, dependency scanning and SBOM, and compliance and evidence automation, which suit small teams that cannot afford manual evidence chasing.
Quick check
Do we need a formal policy document?
A one page document is enough to start. It gives you a dated artifact to attach and a baseline to improve.
What if a reviewer wants more than we have?
Say what you have, state the gap and give a date. Avoid inventing controls to fill the space.
Sources
Last reviewed: 19 October 2026.
