Agent Rules

​

Scope

• Any AI coding agent invoked against a Neuroscale repository — Cursor, Claude Code, GitHub Copilot, Codex, Aider, Cline, Windsurf, and any successor tool.
• Both interactive (human-in-the-loop) and autonomous (agentic / background) sessions.
• All Neuroscale-managed repositories, including infrastructure-as-code, application code, and internal tooling.

​

Deployment

​

What the rules cover

​

Hard prohibitions

1. Commit secrets, API keys, tokens, private keys, or credentials to the repository — including in tests, fixtures, comments, or example files.
2. Disable, weaken, or bypass security controls — pre-commit hooks, branch protection, signed commits, secret/dependency scanning, CSP, CORS, authn/authz, rate limits, WAF rules, CI security gates.
3. Use --no-verify, force-push to shared branches, amend pushed commits, git reset --hard against shared history, or any other action that loses or rewrites work without explicit human approval.
4. Self-approve or self-merge a PR. Branch protection requires at least one approving review from a human other than the author.
5. Paste, upload, or transmit Neuroscale source code, customer data, secrets, PII, internal strategy, or unreleased product information to any AI tool not on the IT allowlist (no consumer-tier ChatGPT, free Claude.ai, personal accounts, or unapproved browser extensions).
6. Generate, “rotate,” or troubleshoot secrets via an AI prompt. Any secret that touches a prompt is compromised and must be rotated per Secrets Management.
7. Log, print, or include in error messages or stack traces: secrets, full request/response payloads, PII, or session tokens.
8. Exfiltrate data — post repository content, customer data, or internal documentation to external chat, pastebins, gists, issue trackers, or third-party tools without explicit human direction for that specific data and destination.
9. Train models on customer prompts, outputs, or content unless the customer has explicitly opted in via a written agreement.
10. Reproduce non-permissively-licensed code. AI-generated code is treated as third-party for license purposes; license-filtering / public-code detection must remain enabled.

​

Required behaviors

• Validate input and encode output at every trust boundary. Use parameterized queries, prepared statements, framework auto-escaping, and array-form subprocess calls (never shell=True).
• Check authn and authz at every endpoint, RPC, queue handler, and admin action — at the data-access layer, not just the route. Filter by tenant/org/owner in the query.
• Fail closed. On error in an authorization, validation, payment, or crypto path, deny the request.
• Pin dependencies in lockfiles. Justify new direct dependencies in the PR description.
• Load production secrets from HashiCorp Vault at runtime (the cross-cloud secrets-of-record for AWS- and Vultr-hosted workloads). Vault is also the source for every production environment variable that holds a secret — DB credentials, third-party API keys, OAuth client secrets, JWT signing keys, encryption peppers, internal service-to-service tokens. The application authenticates via a workload-bound Vault auth method (Vault AWS / Kubernetes / AppRole / OIDC) and reads values at startup. No baked-in env vars, no Dockerfile ENV directives carrying secrets, no static Kubernetes Secret manifests, no kubectl set env, no defaults, no secret = secret or "dev-default" — see Secrets Management → Application configuration and environment variables.
• Log security events — login/logout, MFA, CRUD on users and customer-data objects, security-settings changes, admin access to customer data — with user ID, IP, timestamp, action type, and action object. Redact secrets, payloads, PII at the source.
• Write tests with the change. Bug fixes ship with a regression test that fails without the fix. Auth/authz/validation logic has negative-path tests.
• Make migrations backward-compatible by default. Split destructive changes across multiple deploys.
• Disclose substantial AI assistance in the PR description so reviewers can apply appropriate scrutiny.
• Stop and ask the human when about to do anything on the prohibitions list, when policy is ambiguous, or when authorization for the requested action is unclear. The cost of a question is seconds; the cost of an incident is days.

​

Sensitive areas

​

Remediation SLAs

​

Conflicts

​

Cross-references

• AI Acceptable Use Policy — what AI tools may be used and on what data.
• Secure Development Policy — the parent policy for secure coding and review.
• Operations Security Policy — change management, logging, configuration baselines.
• Incident Response Policy — what to do if a secret leaks or a control is bypassed.
• agent-rules/AGENTS.md — the deployable file.

​

Version history