🧭 Playbook

Days 1–30

• Inventory AI tools in engineeringList every AI tool engineers use — including personal accounts, IDE extensions and MCP servers — with owner, cost, data access and number of users.
• Baseline delivery metricsPull the last 2–4 periods of PRs merged, cycle time, deploys, change-failure rate and review time per team, and enter them in the productivity scorecard.Open →
• Publish an AI use standardOne page: approved tools, allowed data, what needs human review, where to ask. Agree it with security and legal.
• Run the readiness assessmentTake the assessment with your engineering leadership team and pick the three weakest domains to work on.Open →

Days 31–60

• Start a measured pilotPick 2–3 teams for assistants or supervised agents, with comparison teams or a staggered start, and agree the success metrics up front.
• Make security gates mandatoryRequire SAST, dependency and secret scanning on every PR, and route package installs through a proxy with allow-lists.
• Write the agent policyDefine agent identities, allowed environments and tools, approval rules for destructive actions, logging and the kill switch.
• Pick one AI migration programmeChoose a deferred upgrade or migration with good test coverage, and run it as a generate–build–test–retry pipeline.

Days 61–90

• Review pilot resultsCompare pilot and comparison teams on throughput, review time, change-failure rate and cost; use the scorecard's diagnosis to discuss the limiting factor with each team.Open →
• Decide the model gateway and first ADRChoose how AI calls will be routed and controlled, score the options in the build-vs-buy matrix, and file the ADR.Open →
• Set the review policy by risk tierClassify code paths by risk and set review depth per tier, enforced through CODEOWNERS and branch protection.
• Report to leadershipShare a layered view — adoption, delivery impact, quality and cost — with the next quarter's plan and the decisions you need.