Every engineering leader I talk to has the same quiet problem: their developers are already using AI. They’re pasting stack traces into consumer chatbots, asking for regexes, getting help with Terraform. Most of the time it’s harmless. Some of the time it’s a production connection string, a customer record or a chunk of proprietary code going into an account the company has no contract with, no retention control over and no way to audit.
You can ban it. That works for about a week, and then it just moves to personal phones. Banning it also leaves your team behind the people who are learning to work this way.
So we treated AI like any other production system: chosen deliberately, wired into identity, governed by written policy and measured.
Choosing the platform
The selection criteria weren’t really about which model writes the best code. All the frontier models are good at that now. What mattered was the enterprise layer around the model:
- Commercial data terms. Our prompts and code are not used for training, and there’s a clear retention policy.
- SAML SSO and SCIM provisioning, so access follows the identity provider instead of a spreadsheet.
- Admin controls and audit logs, so security can see who is using it and how.
- A real coding workflow, both in the IDE and in the terminal, not just a chat window.
Claude Enterprise met all four, so that’s what we rolled out.
Identity is the control plane
The most important design decision was that nobody gets access any other way. No personal accounts on company devices and no shared logins. Access is granted by group membership in the identity provider, and SCIM pushes those changes to the AI platform automatically.
That one decision solves a surprising number of problems:
- New starters in an engineering group get access on day one without raising a ticket.
- People who leave lose access when their identity is disabled, the same moment they lose everything else.
- Usage can be attributed to a real person and team, which makes the audit log actually useful.
Guardrails that people actually follow
A 20-page AI policy that nobody reads is not a control. The guardrails had three layers:
- Platform settings. Restrict what can be connected, keep audit logging on, and set retention to match our data-handling obligations.
- A one-page acceptable-use guide. It’s written for developers and organized by what you’re about to paste: source code is fine; secrets, credentials and customer data are not; regulated information means stop and ask.
- Existing controls doing their job. Secret scanning in CI and endpoint protection still apply. AI doesn’t get a special exemption, and it doesn’t need one.
The principle was simple: make the safe path the easiest path. If the sanctioned tool is better than the consumer one, already signed in and supported, shadow usage mostly takes care of itself.
Going past “coding assistant”
Once the platform was in place, the bigger opportunity was the IT function itself. Like a lot of operational teams, it ran on manual processes: onboarding checklists, access requests, repetitive lookups across several admin consoles and reports stitched together by hand.
We started building small internal tools with AI help, mostly short Python scripts and automations against the APIs of systems we already had. A typical one compared group membership in the identity provider with the HR system and flagged anyone who still had access but was no longer an active employee.
None of these tools are individually impressive. Together they removed a lot of repetitive work, and they changed how the team thought about its own job. People who had always operated systems started building things, with AI shortening the distance between “this is annoying” and “this is automated.”
What I’d tell another team
- Lead with identity. SSO and SCIM first, everything else after.
- Write the policy for the reader. One page, organized around real situations.
- Don’t stop at code completion. The biggest wins were in the unglamorous operational work.
- Measure adoption. Audit and usage data tell you where enablement is working and where it isn’t.