22 best-practice rules, ready to switch on

The agent is told Keep the agentgov connector on and read the company rules (team_rules) at the start of every session.

Why Every agent knows the rules before it starts.

• Claude CodeE enforced
• CodexT told and reported
• CursorA set in its admin console
• ClaudeA set in its admin console
• ChatGPTA set in its admin console
• other appsT told and reported

In Recommended start · Strict, with customer data · Developers mcp.agentgov_required

The agent is told Use only the MCP servers and connectors on the company list. Before adding a new one, ask IT with team_request.

Why Every connector can read and send company data.

• Claude CodeE enforced
• CodexE enforced
• CursorA set in its admin console
• ClaudeA set in its admin console
• ChatGPTA set in its admin console
• other appsT told and reported

In Strict, with customer data · Developers mcp.approved_only

The agent is told Never send customer personal data (names with contact details, ID numbers, health or payment data) to a tool or service that is not on the company list. Mask it, or ask IT first.

Why Personal data leaving the company is the costliest mistake.

• Claude CodeH told and reported
• CodexH told and reported
• CursorH told and reported
• ClaudeT told and reported
• ChatGPTT told and reported
• other appsT told and reported

In Recommended start · Strict, with customer data data.no_customer_pii_external

The agent is told Never put passwords, API keys or tokens in a chat, a commit or a tool's input. Say where they are kept instead.

Why A key in a chat is a key in someone else's log.

• Claude CodeH told and reported
• CodexH told and reported
• CursorH told and reported
• ClaudeT told and reported
• ChatGPTT told and reported
• other appsT told and reported

In Recommended start · Strict, with customer data · Developers data.no_secrets_in_prompts

The agent is told Never open .env files, private keys or credential stores, even when asked to "look at the config".

Why Secret files are read by accident more than on purpose.

• Claude CodeP partly enforcedA shell command can still read the file (for example cat .env).
• CodexH told and reported
• CursorH told and reported
• Claude- does not apply
• ChatGPT- does not apply
• other appsT told and reported

In Recommended start · Strict, with customer data · Developers files.no_secret_files

The agent is told Before sending a file or data outside the company, say which data class it is. If the rules say it needs approval, ask IT first.

Why IT can only decide what it can name.

• Claude CodeT told and reported
• CodexT told and reported
• CursorT told and reported
• ClaudeT told and reported
• ChatGPTT told and reported
• other appsT told and reported

In Strict, with customer data data.classify_before_share

The agent is told Fetch and send data only to the web domains on the company list.

Why Unknown domains are where data leaks to.

• Claude CodeP partly enforcedCovers shell commands in the sandbox, not the app's own web fetch.
• CodexT told and reported
• CursorT told and reported
• ClaudeT told and reported
• ChatGPTT told and reported
• other appsT told and reported

In Strict, with customer data net.approved_domains

The agent is told Do company work only in the AI tools on the company list. Do not copy company material into other AI tools.

Why Work in unknown tools leaves the company unseen.

• Claude CodeT told and reported
• CodexT told and reported
• CursorT told and reported
• ClaudeT told and reported
• ChatGPTT told and reported
• other appsT told and reported

In Recommended start · Strict, with customer data ai.no_unapproved_ai_tools

The agent is told Use only the AI models on the company list.

Why Contracts and data terms differ per model.

• Claude CodeE enforced
• CodexT told and reported
• CursorA set in its admin console
• ClaudeA set in its admin console
• ChatGPTA set in its admin console
• other appsT told and reported

In Strict, with customer data models.approved_only

The agent is told Before deleting data, force-pushing, dropping tables or changing many records at once, stop and get an explicit yes from the user.

Why Most AI accidents are one command too far.

• Claude CodeP partly enforcedOther ways of deleting (rm -fr, find -delete, a script) are not stopped.
• CodexP partly enforcedCodex asks before commands outside its sandbox, not before every destructive one.
• CursorH told and reported
• ClaudeT told and reported
• ChatGPTT told and reported
• other appsT told and reported

In Recommended start · Strict, with customer data · Developers tools.destructive_needs_approval

The agent is told Never run in a mode that skips the app's permission questions.

Why That mode turns every other rule off.

• Claude CodeE enforced
• CodexE enforced
• CursorA set in its admin console
• Claude- does not apply
• ChatGPT- does not apply
• other appsT told and reported

In Recommended start · Strict, with customer data · Developers perm.no_bypass_mode

The agent is told Never send messages to many customers or contacts at once without an explicit yes from the user.

Why One wrong mail to a thousand people cannot be taken back.

• Claude CodeH told and reported
• CodexH told and reported
• CursorH told and reported
• ClaudeT told and reported
• ChatGPTT told and reported
• other appsT told and reported

In Strict, with customer data email.no_bulk_send

The agent is told Do not add or change hooks or permission settings of your own.

Why Personal settings can switch company rules off.

• Claude CodeE enforced
• CodexT told and reported
• CursorT told and reported
• Claude- does not apply
• ChatGPT- does not apply
• other apps- does not apply

In Strict, with customer data hooks.managed_only

The agent is told Do not upload or paste the company's source code into services or chats that are not on the company list.

Why Code carries secrets and know-how.

• Claude CodeH told and reported
• CodexH told and reported
• CursorH told and reported
• ClaudeT told and reported
• ChatGPTT told and reported
• other appsT told and reported

In Strict, with customer data · Developers code.no_source_to_external

The agent is told Do not run deploy or publish commands. Prepare the change and let a person deploy it.

Why Production changes need a person who answers for them.

• Claude CodeP partly enforcedA deploy run another way (npx, a script, cd and then deploy) is not stopped.
• CodexH told and reported
• CursorH told and reported
• Claude- does not apply
• ChatGPT- does not apply
• other appsT told and reported

In Strict, with customer data · Developers deploy.no_direct_deploy

The agent is told Never force-push and never push straight to the main branch.

Why The main branch is what everyone builds on.

• Claude CodeP partly enforcedA push with a tracked branch, or to HEAD:main, is not stopped. Protect the branch on your git server too.
• CodexH told and reported
• CursorH told and reported
• Claude- does not apply
• ChatGPT- does not apply
• other appsT told and reported

In Developers git.no_force_push_main

The agent is told Put AI-made code changes in a pull request for a person to approve. Never merge your own pull request.

Why Someone has to have read it.

• Claude CodeP partly enforcedMerging on the website or with another tool is not stopped.
• CodexT told and reported
• CursorT told and reported
• Claude- does not apply
• ChatGPT- does not apply
• other appsT told and reported

In Developers review.human_review_before_merge

The agent is told Before touching production systems, production databases or customer accounts, ask IT with team_request and wait for the answer.

Why Production is where mistakes cost money.

• Claude CodeH told and reported
• CodexH told and reported
• CursorH told and reported
• ClaudeT told and reported
• ChatGPTT told and reported
• other appsT told and reported

In Strict, with customer data · Developers prod.access_needs_approval

The agent is told Before building a bot, an agent, a scheduled job or an integration, ask IT with team_request.

Why Automations run when nobody is watching.

• Claude CodeT told and reported
• CodexT told and reported
• CursorT told and reported
• ClaudeT told and reported
• ChatGPTT told and reported
• other appsT told and reported

In Recommended start · Strict, with customer data request.new_automation

The agent is told Before analysing, exporting or moving customer data, ask IT with team_request and follow its conditions.

Why IT decides where customer data may go.

• Claude CodeT told and reported
• CodexT told and reported
• CursorT told and reported
• ClaudeT told and reported
• ChatGPTT told and reported
• other appsT told and reported

In Recommended start · Strict, with customer data request.customer_data_work

The agent is told Call team_activity_report when work starts, before and after any step a rule marks "ask", and when it ends, with one plain sentence about the kind of work.

Why IT can only follow what it can see.

• Claude CodeR reported by the app
• CodexR reported by the app
• CursorR reported by the app
• ClaudeT told and reported
• ChatGPTT told and reported
• other appsT told and reported

In Recommended start · Strict, with customer data · Developers audit.report_activity

The agent is told When text you write will reach customers as it is, say that it was written with AI help.

Why Customers should know when a machine wrote to them. The EU AI Act asks for this in some cases. A code reading, not a legal opinion.

• Claude CodeT told and reported
• CodexT told and reported
• CursorT told and reported
• ClaudeT told and reported
• ChatGPTT told and reported
• other appsT told and reported

In Strict, with customer data ai_act.disclose_ai_output

A code reading, not a legal opinion.