# 17 AI coding agents policy

| | |
| --- | --- |
| Version | 0.1 draft |
| Owner | Security Owner |
| Review | Every 6 months (the tools change quickly) |
| Applies to | Claude Code and any other AI tool that reads code, runs commands, or edits files for Rang & Mall |

## Why this policy exists

Rang & Mall builds with AI coding agents. An agent with a shell can do anything its user can: read every secret on the host, restart production, change a database, push code. Auditors test whether every change and every privileged action belongs to an accountable person and went through review. An agent that acts on production on its own breaks both, and a single broad command from an agent can take down every service on a shared host at once.

## Rules

1. **An agent acts as a named human.** The person who starts the session owns everything it does. There are no agent-owned accounts, API keys or SSH keys with production access (ACC-18).
2. **No agent sessions on production hosts.** Agents run on development machines against development and staging. Production is changed through pull requests and the deploy pipeline, the same as human changes.
3. **Agents never approve.** An agent can write a PR, run tests, and print the [SOC 2 gate](/soc2/05-soc2-gate). It cannot approve a PR, merge to the default branch of an in-scope repository, or mark a control as passed. Branch protection enforces this; the agent's GitHub token, if it has one, has no merge rights on protected branches.
4. **Secrets stay out of the context.** Agents do not read `.env` files or secret stores of in-scope production. A secret that appears in an agent session is treated as exposed and rotated under [15](/soc2/15-cryptography).
5. **Customer data stays out of the context.** Agents do not query production databases holding customer content, and are not given production exports. Debugging with real data uses masked copies.
6. **Destructive commands need a human.** Deleting data, dropping tables, force-pushing, killing processes, changing firewall, DNS, or tunnel configuration, and restarting shared services are confirmed by the human before they run, every time. Kill by process ID only, never by name pattern.
7. **Session logs are kept.** Agent transcripts for work on in-scope repositories are retained for 1 year in [location] so a reviewer can see what the agent did and why. They are evidence for ACC-18 and contain no secrets or customer data if rules 4 and 5 hold.
8. **Approved tools only.** The vendor register lists which agent providers may see which code. Code of an in-scope product goes only to providers listed there with a reviewed DPA.
9. **Memory and instruction files** (CLAUDE.md, memory directories, skills) are code: they live in reviewed repositories, they hold no secrets, and changes to the rules an agent obeys are reviewed.

## Evidence

- Branch protection settings showing agents cannot merge (CHG-01, CHG-02).
- Agent session logs per in-scope repository (ACC-18).
- Rotation records for any secret exposed to a session (ACC-14).