AI Development Governance
This standard defines the required, permitted, and prohibited use of Artificial Intelligence (AI) tools in software development, testing, documentation, and related engineering activities at Thesis. Its intent is to ensure AI is used safely, effectively, and in alignment with Thesis security, quality, and compliance obligations while maintaining full human accountability.
This standard applies to all Thesis employees, contractors, and third-party contributors involved in:
- Software engineering
- QA and test automation
- Platform and infrastructure engineering
- Data engineering
- Technical documentation
This standard covers:
- AI-assisted code generation
- AI-assisted testing
- AI-assisted documentation
- AI-assisted analysis (logs, performance, errors)
Principles of Use
AI tools are assistive, not autonomous. They augment engineering work but do not replace professional judgment, engineering review processes, or accountability.
Key principles:
- Human accountability is mandatory.
- AI accelerates but does not decide engineering outcomes.
- Quality, safety, and security standards remain unchanged.
- Transparency about AI use is required.
Mandated Use of AI
Thesis-approved AI tools must be used where they provide clear efficiency or quality improvements, including: code comprehension and summarisation, refactoring and modernisation, unit test generation, documentation and comment generation, debugging assistance, and identification of performance bottlenecks.
Required Use Cases
Engineers are expected to apply AI tools when:
- Understanding unfamiliar codebases
- Generating draft unit and integration tests
- Producing documentation drafts (comments, READMEs, design summaries)
- Performing initial code clean-up or refactoring
- Investigating errors, stack traces, or log patterns
Optional Use Cases
AI use is permitted (but not required) for:
- Brainstorming design approaches
- Story decomposition
- Creating diagrams
- Research and knowledge lookup
Prohibited Use Cases
AI tools must not be used for:
- Generating full production features end-to-end without any manual oversight
- Producing code the engineer does not fully understand
- Bypassing design reviews
- Bypassing security controls or quality gates
Accountability
Engineers remain fully accountable for the correctness, security, performance, reliability, and compliance of all outputs produced using AI tools.
This includes:
- Verifying the correctness of AI-generated code
- Ensuring security best practices are met
- Ensuring performance standards are upheld
- Ensuring licensing and IP compliance
Controls on AI-Assisted Code
All AI-assisted code must be:
- Fully understood by the engineer before submission
- Reviewed through standard processes (PR, peer review, architecture review)
- Tested thoroughly using Thesis test standards
Additional controls:
- AI may not generate unreviewed design or architecture artifacts
- AI outputs must never be pasted directly into production branches
- AI cannot be treated as a sole code-owner or reviewer
- Pull requests must declare when AI tools have materially contributed to the change
- The submitting engineer must confirm full understanding of the AI-generated output
- AI-assisted changes must undergo standard peer review and may not bypass established change management processes
- Where AI contributes to Tier 3 changes, documented Security or Architecture review is required prior to merge
Testing & Quality Requirements
AI-assisted work is subject to the same testing, QA, security, and quality standards as any manually written code.
AI-assisted changes are subject to all existing CI/CD quality gates, including static analysis, dependency scanning, and automated testing. Coverage thresholds and performance requirements remain unchanged.
Where AI materially influences structural logic, reviewers should consider potential AI-induced edge case omissions during review.
Minimum Requirements
- Full automated test coverage must be maintained
- Security scanning and SAST/DAST pipelines must pass
- Code must meet performance constraints
- Code must meet internal style, readability, and maintainability standards
- Engineers must validate correctness and relevance
- Unstable tests must be identified and resolved
- Tests must reflect realistic behaviour and edge cases
AI-Generated Test Requirements
When using AI to generate tests:
Prompt & Data Discipline
Prompts must not contain sensitive, confidential, personal, or production data unless explicitly permitted under the Thesis Employee AI Usage Policy.
Prohibited in Prompts
- Production database rows or logs
- Customer information
- Credentials or API keys
- Proprietary algorithms
- Internal business strategy
Permitted
- Sanitised and non-sensitive examples
- Abstracted data structures
- High-level problem descriptions
Borderline Cases
- Internal API names
- Non-public architectural diagrams
- Business rules
Monitoring & Measurement
Thesis may monitor AI usage at an aggregated level to support training, tooling, and process improvement. Metrics will not be used as a sole measure of individual performance. Monitoring follows Thesis security and privacy policies.
In addition to aggregated metrics, Thesis may conduct periodic sampling of AI-declared pull requests to assess adherence to this standard. Sampling is conducted for process assurance and improvement purposes only.
Collected Metrics
- Frequency of AI usage
- Tool adoption across teams
- Areas where AI improves efficiency
- Error or quality patterns in AI-assisted work
Not Collected
- Individual prompts
- Source code from prompts
- Personal productivity metrics
Secure Development Lifecycle Integration
AI-assisted work is integrated into Thesis’ secure development lifecycle. AI-generated or AI-modified changes must:
- Comply with secure coding standards
- Be considered during threat modelling where applicable
- Follow established release and change management controls
AI use does not create exceptions to existing engineering governance processes.