The standard
- A policy-guarded AI development harness. Command guards in tiers, a PII gate on agent output, and telemetry on what the agents actually do.
- Branch protection on every repository.
- Secret and PII scanning before code merges.
- A CI budget per repository. Checks are designed to run locally and in one combined job, so the standard does not depend on paid CI minutes.
- A governed skill library for the team's AI assistant, released in waves that each had to pass an evaluation.
How the gates are tested
A gate that has never been seen failing is not a gate. Each check gets an input it must reject. A check that passes on empty input counts as broken, because "found nothing" and "read nothing" look the same from the outside.
Controls are tested at runtime: the test checks what the system actually did, not the exit code of the script that was supposed to stop it. And coverage floors start at the measured level and only go up.
Why one standard
With one standard, a fix or a lesson lands in every repository at once, and a new engineer learns one way of working instead of several. It also gives the team a fair, shared definition of done when agents are doing a large share of the typing.