SAFE AI-ASSISTED DEVELOPMENT
AI Coding Rules
Use AI assistance without weakening engineering review, privacy, security, or production stability.
Production stability and security notice
Development changes must preserve working functionality, Provider isolation, role-based access, HIPAA auditability, released Mobile compatibility, and integration stability. Never deploy AI-generated or unreviewed code directly to production.
Permitted Use
- Drafting targeted code changes from supplied current files.
- Explaining existing code and identifying likely failure points.
- Generating tests, documentation, SQL drafts, and review checklists.
- Comparing before-and-after implementations.
Required Human Controls
| Topic | Standard |
|---|---|
| Grounding | AI must work from the latest relevant files and requirements. |
| Scope control | Do not allow broad refactoring when a targeted fix is required. |
| Verification | Developers must review every line before deployment. |
| PHI protection | Do not send unredacted production PHI, credentials, or secrets into unapproved tools. |
| Testing | AI-generated code requires the same checks as human-written code. |
| Auditability | Security, HIPAA, and support logging must not be bypassed. |
| No invented facts | Do not assume database fields, routes, or integrations that were not verified. |
AI Change Review
- Confirm source files are current.
- Compare the complete diff.
- Check Provider isolation and authorization.
- Run type check, tests, and build.
- Manually test the exact production workflow.