Introducing AI to an Existing Codebase
Unlike a new project, when introducing AI to a long-operated codebase, guardrail design is important. Deciding what to delegate and what to forbid first is the key to preventing incidents.
Pre-Introduction Risk Assessment
1. Code Confidentiality
- Trade secrets, competitive-advantage core: confirm internal rules before sending to AI
- Code with personal info/customer data: masking required
- Config with API keys/credentials: exclusion setting required
2. Size of Impact
- Production-direct code: high risk, human review required
- Tests/utilities: low risk, more freedom
- Migrations: medium risk, rollback plan required
3-Stage Guardrails
1. Scope Limitation
State directories AI may edit. Specify out-of-scope with .cursorignore / .copilotignore.
# .cursorignore secrets/ node_modules/ dist/ *.env production-config/
2. Action Limitation
- Permission mode: "always confirm before executing" setting
- Delete operations: not allowed without explicit approval
- git operations: commit / push by humans
