What you fill in and tick stays in this browser window only. Nothing is sent unless you ask for your result by email. It is gone when you close the page, so print your result.
For CTOs and tech leads whose developers already use Claude Code, Codex or Cursor, each in their own way. The plan does not change your tools. It changes what holds for everyone: rules in the repository, gates in CI, review and measurement.
AI writes all of our code today, and a senior is accountable for the result. Since 2023 we have shipped 15+ production projects. This plan describes how we have it set up ourselves. You can take the skeleton from our public repository claude-code-production-starter.
1. Day 0: measure today
Without baseline numbers you will not know after a month whether anything improved. Three are enough, taken from your last 20 merged PRs:
- Time from opening a PR to merging it. The median, not the average.
- How many PRs came back from review at least once. And why, in one word.
- How many changes were rolled back after deploying. A revert, a hotfix or a fix within two days.
Find out where your team is today in a few minutes with the test How far are you from AI-native SDLC?. The items you are missing there are your work for the next four weeks.
2. The four-week plan
Week 1: rules in CLAUDE.md and AGENTS.md
The agent reads its rules at the start of every task. If they only live in people's heads, every agent works differently. AGENTS.md is read by Codex, Cursor and other tools, Claude Code reads CLAUDE.md. The simplest setup is to keep the rules in AGENTS.md and point to it from CLAUDE.md.
You will find the full rules template in the tool CLAUDE.md and AGENTS.md template. A shorter version to start with:
# Rules for AI agents in this repository
## Commands
- After every change: pnpm verify (typecheck, lint, unit tests)
- Before a PR: pnpm verify:full
## Done means
- tests, typecheck, lint and build pass,
- changed code has a changed or new test,
- the PR template is filled in, including what you did not do.
## The agent never
- connects to the production database,
- reads .env files or keys,
- deploys or runs production migrations,
- edits the test it is graded by to make it pass.Week 2: CI gates and hooks
A sentence in AGENTS.md is a request. The agent can get around it when it is rushing to finish. Whatever matters has to be enforced by a setting, a hook or CI. In Claude Code that is .claude/settings.json (denied and allowed commands) and hooks that run before a command or before the agent says "done".
{
"permissions": {
"deny": ["Read(**/.env)", "Bash(git push --force:*)", "Bash(git reset --hard:*)", "Bash(psql:*)"],
"ask": ["Bash(git push:*)", "Bash(gh pr merge:*)"]
},
"hooks": {
"Stop": [{ "hooks": [{ "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/stop-gate.sh" }] }]
}
}The specific gates with snippets are in the tool How many of 10 gates stop bad AI code in your CI?.
Week 3: review rules and agentic review
When the agent writes faster, review becomes the bottleneck. The rules have to say what a human always checks and what is left to the machine.
Week 4: measurement and team rollout
Measure the same three numbers as on day 0 and compare. Then turn the pilot into the standard for the whole team.
3. Where each rule belongs
A rule that was broken twice moves one level up.
| Level | Strength | Example |
|---|---|---|
| A sentence in AGENTS.md | weakest | "Do not put customer personal data into a prompt." |
| Setting or hook | medium | No reading .env files, a secrets hook before commit |
| CI and a protected branch | strong | Red tests block the merge |
| Lint or test | strongest | A test that fails on the main branch and passes on yours |
More tools for you
12 questions on rules for AI agents, CI checks and accountability. See where your team is today.
Tick the gates you have and see which are missing. Each one with a GitHub Actions snippet.