---
title: "Work from read-only access and delete · Agent Wranglers"
url: https://agentwranglers.se/playbook/due-diligence/scope-and-conduct/read-only-and-delete
id: TDD-2
level: Required
risk: data
updated: 2026-10-27
build: a2a6bdfed830
tokens: 708
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Work from read-only access and delete copies afterwards

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Scope and conduct](https://agentwranglers.se/playbook/due-diligence/scope-and-conduct.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: TDD-2
- Level: Required
- Chapter: [Scope and conduct](https://agentwranglers.se/playbook/due-diligence/scope-and-conduct.md)
- Rule: Review the target's code and systems with read-only access, and paste no code into outside AI tools without written permission. Delete every copy within 14 days of delivering the report.
- Check: A push with the reviewer's access fails. The engagement record holds the written permission for any AI tool used, and a deletion note dated within 14 days of delivery.
- Risk: Data leaked or lost
- How: A review copy of a company's code is a leak waiting to happen. Ask for read-only access to the repository and a staging copy, as [Keep a staging copy with fake data](https://agentwranglers.se/playbook/testing/test-data-and-environments/production-like-staging.md) describes. Agent tools may keep what they read, as [Know what the agent tool does with your code](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/tool-data-terms.md) explains.

## Sources

- [NIST SP 800-53 Rev. 5, AC-6 Least privilege](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Related rules

- TST-26 [Keep a staging environment with generated data](https://agentwranglers.se/playbook/testing/test-data-and-environments/production-like-staging.md) in Testing
- AID-31 [Know what the agent tool does with your code](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/tool-data-terms.md) in AI-assisted development
- TDD-24 [Keep a technical data room ready](https://agentwranglers.se/playbook/due-diligence/preparing-to-sell/technical-data-room.md) in Technical due diligence

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/due-diligence/scope-and-conduct/read-only-and-delete">Agent Wranglers technical due diligence playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Never sign a review of code you have changed](https://agentwranglers.se/playbook/due-diligence/scope-and-conduct/independent-reviewer.md)
- Next: [Tie every finding to a rule ID and evidence](https://agentwranglers.se/playbook/due-diligence/scope-and-conduct/findings-with-rule-ids.md)
- [Scope and conduct](https://agentwranglers.se/playbook/due-diligence/scope-and-conduct.md)