Developer and coding AI

Coding assistants work on the one kind of information that is both output and instruction. The code they read can steer what they write. A comment in a dependency, a snippet on a web page or a file in the repository can carry directions the tool will follow as if you gave them.

That makes this category's governance profile unusual. Every common use here stays on internal information with internal impact, and no customer is on the other end. Yet every use activates protections against untrusted content becoming instruction, and every use raises an intellectual property question, because generated code arrives with licensing history you did not write.

Three of the four tools now run as agents: they execute code, install packages and change files without a person approving each step. For those uses the consequence rises and the agent duties apply. Scope the agent's access to the environment it works in and keep production credentials away from it. Keep a backup it cannot reach. Have a way to stop it. Review what it did rather than trusting what it said it did.

For assistant-style use the governance is lighter: a person reviews what the tool writes before it is committed, and the team knows what may and may not be shown to it.

Open a tool page to see whether your team uses it as an assistant or as an agent. That question decides everything else here.