AID-31Required
Know what the agent tool does with your code
Before an agent reads code or data held for a customer or under a confidentiality agreement, confirm the provider's terms. It must not train on that code and must keep it no longer than the agreement allows.
How to do it
Coding agents send the files they read to the provider's servers. Some plans train on your data unless you turn it off. Choose a business plan or setting that turns off training on your data. Compare the retention period with each customer contract and confidentiality agreement. Write down the retention period. Keep customer data out of the project folder, as the rule above on production credentials says. Record what you find as Record the data terms of every AI provider says.
How to check
The account settings of every agent tool the team uses show training on your data turned off. A note in the repository names each tool, its retention period and the plan it runs on. For each customer project, the note links the contract clause the retention period meets.
Sources
Related rules
- CMP-19 Record the data terms of every AI provider in Compliance and governance
- AID-69 Roll agents out to a team in steps in AI-assisted development
- TDD-2 Work from read-only access and delete copies afterwards in Technical due diligence
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/tool-data-terms">Agent Wranglers AI-assisted development playbook</a>. In code you write, add a comment next to it with the same link.