How to set up an AI-enabled SDLC in a large organisation

Policy

Write the policy before the assistants spread past a pilot. It should name the approved tools, the repositories and data they may see, and the person who can grant an exception.

Approving assistants

Security and procurement approve the assistant. They check where code and prompts are sent, what the provider keeps, and whether the licence on generated code is one you can ship.

Quality gates on AI-assisted changes

An AI-assisted change goes through the pipeline you already run. Add the gates the risk calls for. A person reviews the diff. Tests run on the change. CI runs the static and dependency checks.

Provenance and records

Mark the change with the assistant that produced it. That mark is what an auditor follows later.

Security

Prompts are a poor place for secrets or personal data. Scan the repository and the logs for credentials, and for licence text the generator added.

Measures

Use the measures you already report. Review time, change failure rate, escaped defects. Compare them with the period before the assistants. We do not quote a percentage in advance.

Rollout

Begin with one team, or two. Change the policy where it snags, then add the next team.

Checklist

One page, on this page. No email needed.

• ☐Policy: approved assistants, the code and data they may see, and who signs off exceptions.
• ☐Approving assistants: where code and prompts go, what the provider retains, and the licence terms for generated code.
• ☐Quality gates: human review, tests on every change, and static and dependency checks in CI.
• ☐Provenance: which changes were AI-assisted, and by which assistant.
• ☐Security: secrets and personal data kept out of prompts; scans for leaked credentials and licence issues.
• ☐Measures: review time, change failure rate and escaped defects, before and after.
• ☐Rollout: one or two teams first, then widen.

How Comonad helps