How to Govern AI-Generated Code

Your team didn't ask permission to adopt AI coding tools, and that was the right call — the productivity is real. But somewhere around the point where AI writes half your diffs, an uncomfortable question lands on the CTO's desk: what's our actual policy here? Usually the answer is a shrug. This playbook replaces the shrug.

Below are seven policies we see working inside real engineering organisations. They are written as enforceable rules, not aspirations — each one has a trigger, a condition, and an action, which means each one can be automated. Copy them, edit the thresholds, and you have an AI coding policy by Friday.

The two failure modes to avoid

Before the policies, the two ditches on either side of the road:

• Review everything. Mandating human review of all AI output caps delivery at the speed of your reviewers and quietly teaches engineers to stop tagging AI-assisted work. The policy dies in a month.
• Trust everything. Treating AI diffs exactly like human diffs ignores that their volume, style, and failure modes are different — subtle logic gaps, plausible-but-wrong API usage, and untested surface area at scale.

Everything below follows the middle path: risk-based routing. Routine AI changes clear automatically through gates; the narrow set that needs judgment goes to a named human, with evidence attached.

The seven policies

The 30-day rollout

1. Week 1 — Attribution only. Ship Policy 1. Announce it as observability, not enforcement: "we're learning where AI helps." No gates yet; nobody routes around what doesn't block them.
2. Week 2 — Baseline. Measure: AI share by repo, coverage in AI-heavy modules, review load. Pick thresholds from your data, not this article's defaults.
3. Week 3 — Enforce three. Turn on Policies 2, 5, and 7 — the human-review rule, the freeze, and the evidence log. Escalations must go to a named role with context attached, never a shared channel.
4. Week 4 — Review the ratio. Healthy target: 95%+ of changes clear automatically. If more than ~5% routes to humans, your conditions are too broad — tighten them before the team feels the drag.

Enforcement is the hard part

Everything above can live in a wiki and change nothing. The difference between a policy document and a governed pipeline is mechanical enforcement: something has to read every change, apply the conditions, route the escalations, and write the evidence log — continuously, without a human remembering to check.

That enforcement layer is what AI delivery governance platforms exist to provide. (It's also exactly what DryDock's agent crew does — each policy above maps to a trigger → condition → action agents run for you.)