Is your AI access ready for security review?

Seven yes-or-no questions about how your AI coding tools reach your internal systems. It takes two minutes. Your answers stay in your browser and are not sent anywhere.

Question 1 of 7

Does security keep an approved list of the AI tools your engineers can use?

Question 2 of 7

When an AI tool reaches an internal system, does it act as the signed-in person, with only that person's permissions?

Question 3 of 7

Does that access go through the identity provider you already run (Entra, Okta or similar)?

Question 4 of 7

Can you see a log of what AI tools read or changed in your systems?

Question 5 of 7

Could you cut off one AI tool's access to one system within minutes, without breaking everything else?

Question 6 of 7

Is there a written rule that a person reviews AI-generated code before it merges?

Question 7 of 7

Are your team's coding and security standards written down in a form the AI is told to follow?

Notes on AI and engineering teams

I write about AI, engineering leadership and decision science on Substack. It’s free.

Read the archive first