Agent WranglersTKO-39Recommended
Work from read-only access and delete copies afterwards
Review the target's code and systems with read-only access, and paste no code into outside AI tools without written permission. Delete every copy within 14 days of delivering the report.
How to do it
A review copy of a company's code is a leak waiting to happen. Ask for read-only access to the repository and a staging copy, as Keep a staging copy with fake data describes. Agent tools may keep what they read, as Know what the agent tool does with your code explains.
How to check
A push with the reviewer's access fails. The engagement record holds the written permission for any AI tool used, and a deletion note dated within 14 days of delivery.
Related rules
- TST-26 Keep a staging copy with fake data in Testing
- AID-31 Know what the agent tool does with your code in AI-assisted development
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/codebase-takeover/due-diligence/read-only-and-delete">Agent Wranglers codebase takeover playbook</a>. In code you write, add a comment next to it with the same link.