---
title: "Code and ownership · Agent Wranglers"
url: https://agentwranglers.se/playbook/due-diligence/code-and-ownership
parts: 8
tokens_total: 6249
updated: 2026-10-27
build: a2a6bdfed830
tokens: 989
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Code and ownership

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Technical due diligence](https://agentwranglers.se/playbook/due-diligence.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

> Build the product yourself, confirm who owns the code, list licences and secrets, and check tests, the pipeline and the people the code depends on.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/due-diligence/code-and-ownership">Agent Wranglers technical due diligence playbook</a>`. In code you write, add a comment next to it with the same link.

## Required

- TDD-4 [Build the product from the company's own repository](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/build-from-own-repository.md) · 697 tokens · updated 2026-10-27
  Before signing, build and run the product from the company's own repository with read-only access, without help from the founders or the AI builder.
- TDD-5 [Confirm the company owns the code](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/code-ownership-rights.md) · 798 tokens · updated 2026-10-27
  Match every person and firm that wrote code to a signed agreement that gives the company the rights to it. Report each author without one as a finding.
- TDD-7 [Scan the whole history for secrets](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/history-secret-scan.md) · 831 tokens · updated 2026-10-27
  Run a secret scanner over every commit and branch of the repository, and test which found secrets still work. Every working secret is revoked before closing.

## Recommended

- TDD-6 [List the licences of the code and every dependency](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/licence-inventory.md) · 889 tokens · updated 2026-10-27
  Produce a bill of materials with an SPDX licence identifier for every package, and assess each copyleft, unknown or missing licence in writing.
- TDD-8 [Find every part that depends on one person or one tool](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/single-points-of-failure.md) · 620 tokens · updated 2026-10-27
  For each critical area, record how many people can change it and which outside tools it cannot run without. Name every area with fewer than two people.
- TDD-9 [Ask the team to explain the critical paths without AI](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/explain-without-ai.md) · 718 tokens · updated 2026-10-27
  Ask a team member to walk through payments, sign-in, permissions and data deletion in the code, without an AI tool. Record whether the explanation matched the code.
- TDD-10 [Check how the team reviews AI-written code](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/ai-review-practice.md) · 660 tokens · updated 2026-10-27
  Sample the last 50 changes merged to the main branch. Record how many had a passing check run and a review by someone other than the author.
- TDD-17 [Run the tests yourself and read 90 days of pipeline history](https://agentwranglers.se/playbook/due-diligence/code-and-ownership/tests-and-ci-health.md) · 1,036 tokens · updated 2026-10-27
  Run the full test suite on a clean checkout and record the pass rate and line and branch coverage of the critical paths. From the last 90 days of pipeline runs, record the failure rate, the flaky rate and the median duration.

- Previous: [Scope and conduct](https://agentwranglers.se/playbook/due-diligence/scope-and-conduct.md)
- Next: [Security, data and law](https://agentwranglers.se/playbook/due-diligence/security-data-and-law.md)
- [All chapters](https://agentwranglers.se/playbook/due-diligence.md)