Use AI for drafts, explanations and routine code, but review every line, run tests, keep secrets and customer data out of prompts, and stay the owner of what ships. Do not merge code you do not understand, and do not give AI tools access to production systems. These rules keep the speed and remove most of the risk.
Do
- Review everything it writes. Read the diff as you would a colleague's pull request.
- Ask for small changes. One task at a time is easier to check than one huge rewrite.
- Give it context. Share the relevant files, conventions and the business rules in plain language.
- Write or generate tests, then run them. Check that the tests are meaningful, not just passing.
- Run the type checker, linter and the app. Do not trust "it should work".
- Verify claims. If it says it fixed something, reproduce the problem and confirm.
- Use version control, with small commits you can revert.
- Keep a human owner responsible for every change.
- Check dependencies. Confirm packages exist, are maintained and are what you intended.
- Document decisions so the next person understands why.
Don't
- Don't paste secrets, API keys, passwords or customer data into prompts. See never paste secrets into an AI assistant.
- Don't merge code you do not understand.
- Don't let agents act on production or on live data.
- Don't skip security review on authentication, payments, permissions and data storage. See security risks of AI-generated code.
- Don't trust invented details. AI can make up functions, options and facts.
- Don't accept big-bang changes you cannot review.
- Don't ignore licensing and data terms of the tools you use.
- Don't assume passing tests mean correct if the tests were also written by AI and never checked.
- Don't stop learning how your own system works.
A simple team policy
| Area | Rule |
|---|---|
| Data | No secrets or customer data in prompts |
| Review | All AI-written code is reviewed by a person |
| Testing | Tests must pass before merge |
| Access | AI tools have no production access |
| Ownership | A named developer owns each change |
| Records | Record which tools are approved |
Why this matters for business owners
If a developer or agency uses AI, these habits are what you are really paying for. Ask them to describe theirs. See AI coding: a practical guide for business owners and our custom software development service.