AI Usage Policy

Purpose and Scope

As a professional services firm, Tkxel serves as the custodian of our clients’ intellectual property (IP). While Artificial Intelligence (AI) offers significant opportunities to enhance productivity and code quality, it also introduces risks related to data privacy, IP leakage, and security.

This policy establishes the mandatory standards for the use of Generative AI tools at Tkxel. It is aligned with ISO 42001 standards for AI Management Systems, prioritizing risk management, transparency, and accountability.

Core Principles

1. Client Trust First: We never sacrifice client confidentiality for convenience.
2. Human Accountability: AI is a tool, not a replacement. The user is fully responsible for the output generated.
3. Zero-Retention Default: We presume all inputs to freely available AI models become public data; therefore, sensitive inputs are prohibited.

Authorized Tooling & Personal Usage

To ensure security and compliance, the following rules apply to tool selection:

• Authorized Tools Only: Employees may only use AI tools explicitly vetted and approved by the Tkxel IT & Security Office (e.g., GitHub Copilot Enterprise, ChatGPT Enterprise).
• Prohibition of “Free/Public” Models: The use of free, public-tier AI models (e.g., free ChatGPT, consumer Gemini, public Claude) for work purposes is strictly prohibited. These models often train on user data, leading to immediate data leakage.
• No Personal Accounts: Using personal email addresses to sign up for or access AI tools for work tasks is forbidden. All access must be provisioned via Tkxel Single Sign-On (SSO).
• Device Restriction: Personal AI tools or browser extensions must not be installed on company-issued hardware.
• Cost Guardrails: When provisioning third-party AI models (e.g., via API for development), proper billing guardrails and hard budget limits must be configured to avoid cost surprises or runaway loops.

Data Privacy & IP Protection (ISO 42001 Control)

Tkxel holds strict liability for client data, and this is a shared responsibility of team members using AI tools, specifically the delivery lead of the team. The following data types must NEVER be entered into an AI prompt, regardless of the tool’s security settings or model type:

1. Personally Identifiable Information (PII): Names, addresses, emails, and government IDs of staff or client users.
2. Protected Health Information (PHI): Any medical or health-related data.
3. Client Credentials: Passwords, API tokens, cloud provider keys, or encryption keys.
4. Proprietary Business Logic: Highly specific algorithms or trade secrets that constitute the core value of a client’s business.

Breach Consequence: Inputting sensitive client data into a public AI model is considered a severe security violation and will result in disciplinary action, up to and including termination.

Engineering & Development Guidelines

This section applies specifically to Software Engineers, DevOps, and QA personnel.

Context Optimization & Token Efficiency

To prevent redundancy, waste of resources, and potential data leakage through excessive context sharing:

• Structured Context Loading: Do not paste raw code files repeatedly into the chat context.
• The “README First” Approach: Engineers must ensure repositories have robust README.md and ARCHITECTURE.md files. These files should be passed to the AI once to establish context.
• Modular Prompting: Focus prompts on specific functions or modules rather than entire codebases.

Secrets Management & Sanitization

AI tools do not respect gitignore rules if you manually copy-paste code.

• The “.env” Rule: Code submitted to AI must be strictly sanitized. Ensure no hardcoded secrets exist.
• Review Process: Before pasting any code block into an AI tool, the engineer must verify that the snippet does not contain:
  • API Keys (First or Third Party)
  • Database connection strings
  • Private certificates
• Env File Isolation: .env files and other secret-bearing configuration files must remain in .gitignore and must never be shared with an AI context window.
• Mandatory Key Rotation: To mitigate risks associated with potential leakage, all API keys and secrets used in AI-assisted projects must be short-lived and rotated every 3 months. This rule applies to both Sandbox/Dev and Production environments.

Code Validity & Security

• No Blind Copy-Pasting: AI-generated code is prone to “hallucinations” and security vulnerabilities (e.g., importing non-existent or malicious packages).
• Review Mandatory: All AI-generated code must be reviewed line-by-line, understood, and tested by the engineer before being committed.
• Total Ownership & Maintainability: The team must possess a complete understanding of all AI-generated code, treating it exactly as if it were hand-written. The current team assumes full responsibility for all future change requests, debugging, and maintainability issues; attributing complexity or errors to “AI generation” is not acceptable.
• Mandatory Human-Vetted Testing: All AI-generated logic must be accompanied by comprehensive unit test cases. These tests must be written or rigorously vetted by a human engineer to ensure they accurately validate the business logic and are not merely hallucinated tests passing against hallucinated code.
• Library License Compliance: AI frequently suggests third-party libraries. All such libraries must have “blessed” licenses (e.g., MIT, Apache 2.0). Including libraries with prohibitive licenses (e.g., GPL, AGPL) that are restricted for commercial use is strictly forbidden, and the liability of violation falls on the delivery lead directly.
• Static Analysis: AI-generated code is subject to the same CI/CD gates, SonarQube scans, and security reviews as human-written code.

Team Governance & Oversight

• Delivery Lead Responsibility: Delivery Leads act as the mandatory “Human-in-the-Loop” ensuring layer. They are responsible for:
  1. Validating the specific use case of AI tools for their respective teams.
  2. Obtaining necessary approvals before authorizing AI tool usage within the team.
  3. License Accountability: Ensuring all AI-suggested libraries comply with commercial licensing standards. The Delivery Lead bears ultimate liability for any IP infringement or license violations resulting from AI-introduced dependencies.
  4. Monitoring team compliance with this policy.

Client Consent & Transparency

As a service provider, we cannot unilaterally decide to process client IP using third-party AI processors.

• Mandatory Opt-In: AI tools may not be used on any project without the explicit, written consent of the Client Stakeholder.
• Disclosure: We must disclose which tools are being used and how their data is handled (e.g., “We use GitHub Copilot for code completion, which retains data for 0 days”).
• Project Specifics: If a client prohibits AI usage, the Project Manager must configure the repository settings to disable AI tool integrations for that specific project.

Liability & Accountability

In alignment with ISO 42001 risk controls:

• User Liability: The individual employee is liable for any security incident, IP breach, or production outage caused by the unverified use of AI suggestions. “The AI wrote it” is not a valid defense.
• Indemnification: Use of unauthorized AI tools shifts liability for data breaches directly to the user.
• Incident Reporting: If you suspect you have accidentally pasted sensitive data into a public AI model, you must report it to the Security Team immediately (within 1 hour) to mitigate damages.

Account Lifecycle Management

To optimize resource utilization and maintain a secure perimeter, the NOC (Network Operations Center) Team is responsible for the following:

• Standardized On-boarding: AI tool access must only be granted through a formal request from the Delivery Lead. The NOC team will provision accounts using the company SSO and ensure the user is added to the correct billing group.
• Immediate De-activation: Upon an employee’s exit or transfer out of a project that requires AI tools, the NOC team must deactivate the person’s AI accounts within 24 hours.
• Resource Audit: The NOC team will conduct a monthly audit of AI account activity. Inactive accounts (no login for 30 days) will be flagged for deactivation to prevent wastage of company resources.

Policy Acknowledgement

I acknowledge that I have read and understood the Tkxel AI Acceptable Use Policy. I agree to adhere to these guidelines and understand that violations may result in disciplinary action.