Hop til hovedindhold

AI Assisted Development

The use of AI-Assisted Development is encouraged as a standard part of the development workflow in the solution, where this document aims to describe the strategy and policy of AI agent usage.

Strategy​

Our AI usage strategy is built on one core principle:

Coding agents must automatically have knowledge of our architecture and domain.

This creates several benefits:

  • Knowledge-sharing. Agents automatically apply the latest architectural decisions and domain knowledge, which ensures that AI-assisted development automatically consumes changes to our architecture and domain model.
  • Ease of onboarding. Developers do not need to know how to brief the agent correctly for our solution. The agent follows the guidelines and domain automatically, allowing new and existing team members to contribute fast.
  • Consistency. Without explicit knowledge of the target architecture, an agent will imitate the code around it. In a developing codebase, that means AI can reinforce legacy patterns we are trying to replace. Having a defined target architecture prevents that.

The practical consequence: when we make an architectural decision, we write it into the agent instructions. These instructions are not a one-time setup artifact. They are a living contract that evolves with the system.

Implementation of strategy​

The strategy is implemented through two complementary mechanisms: AGENTS.md and SKILL.md files. AI coding agents such as GitHub Copilot and Claude Code are supported, however the AGENTS.md and SKILL.md are quite widespread standards.

The distinction can be summarized as follows:

  • AGENTS.md is selected by location in the file tree
  • SKILL.md is selected by the nature of the task.

AGENTS.md - Architectural principles​

AGENTS.md describes how to work within a given area of the file structure. It follows an open standard supported by many AI coding agents: https://agents.md/

These files are automatically added to the agent’s context based on the folder in which it is working. The agent loads the root-level file together with any additional AGENTS.md files that apply to the relevant part of the repository. No manual action is required from the developer.

  • An AGENTS.md file at the repository root contains foundational domain knowledge and general architectural principles.
  • Additional AGENTS.md files can be placed in subfolders to provide guidance specific to a domain, technology, or area of the codebase. For example, how to build, run, or test in that area.

Because applicable AGENTS.md files are loaded automatically based on the agent’s location in the file hierarchy, they can consume context and potentially overload the agent with information. Prefer skills when guidance should be loaded only for a particular type of task.

SKILL.md - Expert knowledge for specific tasks​

A skill is a collection of expert guidance for a particular type of task.

Reference: https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/add-skills

  • Skills are stored in .github/skills/<skill-name>/SKILL.md.
  • The agent decides when a skill is relevant and loads it into context. For example, a request about reviewing a pull request will automatically activate in the code-review skill, while a request about adding a database column may activate database-migration.
  • Each skill includes a name and description in its front matter. This metadata is always included in the AI context and helps the agent determine when the skill should be used.

Skills are well suited to knowledge that is task-specific, conditional, or cross-cutting, including:

  • Instructions for performing a task, such as conducting a code review.
  • Guidance for specific situations, such as debugging a particular type of error.
  • Specialized domain knowledge, such as detailed area-specific business requirements.

Safety​

Security and safety boundaries are enforced by limiting what tools an agent can access, not by asking it nicely in a prompt.

Prompt-based instructions ("do not touch production", "never read secrets") are guidance, not a control. They can be misread, overridden by later context, or simply ignored. Anything that genuinely must not happen is enforced at the tool, credential, and permission level.

  • Restrict, do not instruct. Boundaries are enforced through tool scoping, sandboxin, credentials, and permissions, not prompt wording.
  • Least privilege. Agents operate with the permissions of the developer running them. Never wire an agent to elevated or shared service credentials.
  • No access to secrets. Secrets, connection strings, certificates, and other credentials must not be available to an AI agent.
  • No access to sensitive data. Sensitive data e.g. personal information, must not be accessable to an AI agent. Data must be masked or anonymized before it is made available for AI-assisted analysis.

Human accountability​

An AI agent is a tool, not an author. The developer who submits the work is the author and is fully responsible for it — the same standard as code written by hand. "The agent wrote it" is not an explanation for a defect.

All changes go through a pull request in Azure DevOps and require human review. AI-assisted changes are held to the standard in the code-review skill: correctness, edge cases, architectural conventions, tests, and no committed secrets.