Published via [GitHub Executive Insights](https://github.com/solutions/executive-insights "Executive insights, curated just for you") | Authored by [Matt Nigh](https://github.com/mattnigh), Program Manager Director of AI for Everyone

Our playbook on [building an AI-powered workforce](https://resources.github.com/enterprise/ai-powered-workforce-playbook/) focused on the idea that adoption is a change-management challenge. The foundation of that change is trust, and trust is built on clear, practical policies. 

Without clear rules for AI adoption and usage, employees face a paralyzing choice: They can either avoid using powerful new AI tools for fear of breaking a rule they don't know exists, or they can forge ahead, potentially exposing the company to security risks and data leaks. The first hinders innovation and the second creates avoidable risk.

This post provides **a practical blueprint for creating an AI policy framework —** effective AI guardrails that will empower your employees to experiment, innovate, and adopt new tools safely in this new AI era.

## Start with a data classification standard

Before you can set rules for tools, you must have clear rules for your data. A policy that says, "don't use sensitive data in public AI tools" is meaningless if your employees don't have a shared understanding of what "sensitive" means.

This is why a simple, clear data classification standard is critical. It gives employees a mental model to assess risk on the fly. You don't need a complex system; a few tiers are usually sufficient. For example:

* **Public:** Information that is already public or approved for public release.  
* **Internal:** Non-public company information that is generally available to all employees but would not be shared externally (e.g., internal announcements, project plans).  
* **Confidential:** Sensitive information accessible only to specific teams or individuals (e.g., unannounced financial results, employee PII, pre-release source code).

With this foundation in place, your AI usage policies become instantly more practical and actionable for every employee.

## A simple framework for a complex landscape

The AI tool ecosystem is evolving at a dizzying pace. To avoid creating a complex web of rules that no one can follow, we recommend a simple, three-tiered framework that categorizes tools based on risk and data sensitivity. Below is an example of how we tier our own tooling.

### Tier 1: Approved and enterprise-ready tools

This is your "green light" category. These are the tools that have been fully vetted by your Security, Legal, and IT teams. They have enterprise-grade security controls and a formal contract in place. For us, this includes tools like GitHub Copilot, Microsoft 365 Copilot, Slack AI, Zoom AI, etc,. These tools should take up the bulk of your use cases, and be the primary AI tools your organization uses.

* **The policy:** Employees can use these tools with **internal** and **confidential** data.  
* **Why it matters:** This provides a powerful, secure, and versatile set of default tools that can meet the vast majority of employee needs, giving them a safe sandbox in which to work and innovate.

### Tier 2: Unvetted public tools 

This category includes the vast world of free, public AI models and services that do not have a formal enterprise agreement with your company. These should be used primarily in edge cases.

* **The policy:** The rule here is simple and absolute: **Public data only.** Employees must not input any proprietary company code, customer data, or internal-only information into these tools.  
* **Why it matters:** This policy allows for low-risk experimentation and learning. Employees can still use these tools to explore new capabilities, learn prompting techniques, and stay current with  state-of-the-art technology, all without exposing sensitive information.

### Tier 3: Local-only AI tools 

A growing category of powerful AI tools can run entirely on an employee's local machine without sending any data to the cloud (e.g., LM Studio, MacWhisper).

* **The policy:** These are generally safe for a wide range of data, but with two key caveats. Employees must ensure that any features that could transmit data (like cloud sync or automatic transcription services) are disabled. For use with highly sensitive data, a quick consultation with your IT/Security team should still be required.  
* **Why it matters:** This empowers advanced users to leverage powerful models for sensitive tasks, while still maintaining a crucial security checkpoint.

## Handling special cases

No framework can perfectly capture every scenario. A mature policy acknowledges and plans for exceptions, as you will inevitably encounter tools that don't fit neatly into the three tiers.

* **Experimental and pilot programs:** Your most innovative teams will build or discover new AI tools that aren't ready for a full enterprise rollout. Create a specific "Experimental" category for these tools. The policy should be strict, and should consider treating them like Tier 2 tools (public data only), but their existence creates a sanctioned space for R\&D. This allows innovation to flourish without waiting for a full security review, with a clear path to graduate to Tier 1 once proven.  
* **Department-specific tools:** A one-size-fits-all toolset is a myth. Your sales team may need a specialized AI-powered CRM tool that is irrelevant to engineering. Your policy should include a clear, lightweight process for individual departments to get approval for their specific tools. This provides flexibility and ensures teams have what they need to succeed.

## Making your policies usable

The best policies are useless if no one knows they exist or if they are too difficult to understand. To make your guardrails effective, you must make them accessible.

1. **Create a central, simple list:** Don't bury your policies in a 50-page document. Create a simple, easy-to-scan page on your internal wiki that lists the approved tools for each tier, including any special cases.  
2. **Provide clear points of contact:** Designate a specific place where employees can ask questions and get fast answers. For us, a dedicated Slack channel (`#security-help`) where employees can ping the security team directly has been invaluable.  
3. **Socialize and educate:** Regularly communicate your policies in company all-hands meetings, newsletters, and through your AI Advocate network. The goal is to make the "rules of the road" a part of the company's shared knowledge.

By implementing clear guardrails, you are not slowing down your AI adoption. You are building the foundation of trust and safety that gives your employees the freedom and confidence to move fast, experiment boldly, and unlock the full potential of AI.

## Putting it all together

Creating effective AI guardrails isn't about locking things down — it's about unlocking safe, scalable adoption. Clear policies give employees the confidence to move fast without second-guessing what’s allowed. They turn ambiguity into alignment.

With a strong data classification model, a practical tool-tiering framework, and a lightweight evaluation process, you equip your organization to keep pace with AI’s rapid evolution — without sacrificing trust, security, or momentum.

---

Want to learn more about the strategic role of AI and other innovations at GitHub? Explore [Executive Insights](https://github.com/solutions/executive-insights) for more thought leadership on the future of technology and business.

By creating clear, practical policies and a framework for tiered tool usage, companies can build the trust necessary to empower employees and safely scale AI adoption.

hero-4

Resource Page for /enterprise/creating-clear-ai-policies-guardrails

Playbook series: Creating clear AI policies and guardrails

Resource Page for /enterprise-content-roundup/october

October ‘25 enterprise roundup

Published via [GitHub Executive Insights](https://github.com/solutions/executive-insights "Executive insights, curated just for you") | Authored by [Bronte Van der Hoorn](https://github.com/brontevdh)

At GitHub, accessibility isn’t just about compliance. It’s about ensuring every developer can do their best work. When the GitHub Licensing team needed to address critical accessibility improvements while maintaining their roadmap commitments, they turned to [GitHub Copilot coding agent](https://github.blog/news-insights/product-news/github-copilot-meet-the-new-coding-agent/) as an accessibility champion.

## Prioritizing accessibility while maintaining momentum

The Licensing team faced a common engineering dilemma: important accessibility improvements from two audits needed addressing before a deadline. The work was substantial enough to potentially impact roadmap delivery, yet essential for creating an inclusive product experience.

Instead of the traditional approach of reallocating engineers, they asked: "What would this look like if agents were already part of the team?"

## From concept to concrete results

The team delegated the outstanding accessibility issues to the Copilot coding agent in batches, with an engineer serving as reviewer and safety net across several short working sessions. The results demonstrated significant potential:

* 70% of issues: Smooth landings where the agent implemented correct solutions with minimal guidance  
* 10% of issues: Needed human co-piloting to reach an acceptable solution  
* 20% of issues: Required the engineer to take a more hands-on approach

Most importantly, the team resolved all accessibility issues without disrupting their roadmap commitments.

"Despite a learning curve and the assistance we needed to provide the agents, we achieved our aim of delivering both our roadmap and our accessibility goals."   
*Josh Schultz, GitHub Engineering Team Leader*

## Where agents excel in accessibility work

The experiment revealed clear strengths where AI agents can provide the most value to teams:

* *Standardized improvements:* Adding server names to links, fixing aria-label mismatches, and making heading structure changes  
* *Bounded modifications:* Small, well-defined changes with clear success criteria  
* *Documentation and labeling:* Ensuring proper annotations for assistive technologies

“This isn't about deprioritising accessibility. For us, it's about watching agents actually shoulder important work that makes our product more inclusive for everyone.”   
*Josh Schultz, GitHub Engineering Team Leader*

## How to integrate agents into your accessibility workflow

Our Licensing team's experience yielded several practical insights for teams looking to leverage AI agents effectively:

1. *Batch for efficiency:* Plan for some overhead with each agent interaction; batching reviews keeps things streamlined.  
2. *Use AI to prepare for AI:* Copilot Chat can quickly transform raw notes into agent-ready tickets, streamlining the preparation process.  
3. *Fix small nits yourself:* Tiny fixes are often faster to implement directly than through an agent feedback cycle.  
4. *Be precise in feedback:* Crystal-clear pull request comments (e.g., "Remove Y first, then add X") increase the likelihood of agent success on the next attempt.  
5. *Proactive labeling:* As you review your backlog, label agent delegatable items.

## The multiplier effect

The GitHub Licensing team's experience demonstrates that AI agents can function as team multipliers, allowing engineers to maintain focus on high-priority roadmap items while still addressing critical accessibility work. This creates ways of working that aren’t simply additive but potentially multiplicative.

For engineering leaders, the implications can be transformative: AI agents aren't replacing accessibility expertise — they're increasing your ability to attend to this critical work without deprioritising your feature roadmap. By thoughtfully integrating agents into your workflow, particularly for well-defined accessibility tasks that might otherwise need to wait for the next sprint, you can maintain velocity on your roadmap while creating more inclusive products now.

In this new era of development, the teams that thrive won't just be those with the most resources, but those who most creatively harness the complementary strengths of humans and AI to deliver better, more accessible experiences for everyone.

---

Want to learn more about the strategic role of AI and other innovations at GitHub? Explore [Executive Insights](https://github.com/solutions/executive-insights) for more thought leadership on the future of technology and business.

Facing a critical accessibility deadline, a GitHub team decided to experiment with a new approach: delegating the work to AI agents.

Hero-3

Resource Page for /how-github-licensing-used-ai-agents-champion-accessibility

How GitHub's Licensing team used AI agents to champion accessibility

This webinar is in Japanese only: GitHub Latest Updates Webinar on September 29th

Aep29GHWebinar

Resource Page for /video/jp-2025sep-webinar

Video and materials released: GitHub Latest Information Webinar held on September 29th

KOREAN ONLY CONTENTS:
Catch up on the latest information on GitHub products released daily. In this webinar, we will summarize the updates announced in the Changelog by product, such as GitHub Copilot, Actions, and security. 
<br>
<iframe width="560" height="315" src="https://www.youtube.com/embed/zVLQ4i-4tA4?si=el5TiPKQANVmYrWF" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
<br>
<strong>Download presentation slides below: </strong><br>
<a href="https://assets.ctfassets.net/wfutmusr1t3h/1hFjP6T5v0XWK9qawQgCV0/00646dead2c9e97840023b4fb938a6f1/KR_GitHubCopilot_Webinar_Aug25.pdf">KR_GitHubCopilot_Webinar_Aug25</a>
<br>
<br>
<a href="https://x.com/githubkr">GitHub Korea official X (formerly Twitter) account</a> posts the latest information. Please follow us.

This webinar is in Korean only: Introducing the latest GitHub updates

KRAug21GHWebinarZoomHeader

Resource Page for /video/kr-2025aug-ghwebinar

Video and slides published: GitHub update webinar on Aug 21 (in Korean)

<div class="embed-responsive embed-responsive-16by9">
  <iframe src="https://www.youtube.com/embed/X1gKM2gXjX4" width="640" height="375" frameborder="0" allowfullscreen></iframe>
</div>

Join us for a walkthrough of the latest product updates and the priorities shaping GitHub’s roadmap as we navigate one of the fastest moving markets in software development.

We’ll cover our latest advancements in agent-powered developer experiences, dive into MCP Server enhancements, and give you a closer look at some of our newest features with hands-on demos.

Whether you're deep in the code or leading a team, this is your opportunity to see what’s coming, ask questions live, and get inspired by what’s ahead.

Form_Ungated_Contact

Tell us more about your needs

Wondering how GitHub can help your business?

Get a first look at what’s next from GitHub

A stylized GitHub Octocat logo within a segmented green circle on the left. On the right, bold text reads 'GitHub Roadmap Webinar' with a label below stating 'GITHUB WEBINAR SERIES // Q3 2025' on a light green gradient background.

/webcasts/github-roadmap-webinar-q3

Resource Page for /webcasts/github-roadmap-webinar-q3-americas-europe

Marketo Campaign for /webcasts/github-roadmap-webinar-q3-americas-europe

GitHub Roadmap Webinar, Q3 2025 - The Americas and Europe

Home > Bottom > Banner (Accelerate...)

Curate blazing fast developer environments and help your organization be more agile, secure, and efficient.

Home > Bottom > Card #1 (Codespaces)

Ship secure applications with a community-driven, developer-first approach.


Home > Bottom > Card #2 (Adv. Sec.)

Automate your software workflows with a powerful DevOps toolkit and built-in CI/CD.

Home > Bottom > Card #3 (Actions)

Safely publish and consume packages within your organization.

Home > Bottom > Card #4 (Packages)

Home > Feature > Banner > CTA

Home > Feature > Banner (Learning Pathways)

Bring the power of generative AI to engineering teams with GitHub Copilot. Learn how you can maximize developer velocity and innovation.


Copilot card

Stay one step ahead by shipping your software securely within GitHub: Identify and fix security issues directly in the developer flow.

Security Card

Learn why more than 90% of the Fortune 100 use GitHub—the leading developer platform compared to alternative solutions.

Why GitHub? Card

Become a GitHub expert in CI/CD, application security, governance, and AI-developer tools through expert-guided learning pathways with tips and insights from leading enterprise organizations.

Resource Page for /learn/build-like-the-leading-tech-innovators

CO-GHG-CONTACT-FY23-10Oct-01-WW-Resources-Contact-Request/406214

GitHub Learning Pathways

Home > Final > Banner > CTA

Home > Final > Banner (Sales Team)

Home > Hero > CTA #1

Home > Hero > CTA #2

Set your business up for success with solutions to any number of common questions.

Playbook series: Creating clear AI policies and guardrails

October ‘25 enterprise roundup

How GitHub's Licensing team used AI agents to champion accessibility

Browse by topic

Latest videos

Video and materials released: GitHub Latest Information Webinar held on September 29th

Video and slides published: GitHub update webinar on Aug 21 (in Korean)

GitHub Roadmap Webinar, Q3 2025 - The Americas and Europe

Accelerate innovation with the platform developers love

Codespaces

Advanced Security

Actions

Packages

Questions? Reach out to our sales team