Course Objective & Scope
Uncontrolled use of personal AI coding accounts and unvetted MCP plugins (Shadow AI) exposes proprietary source code, risks restrictive open-source licence contamination and violates regulatory rules—while blanket bans cripple engineering velocity. This course teaches how to design practical enterprise AI coding policies that enable engineers safely.
Enterprise licensing and Zero Data Retention (ZDR) architectures, open-source copyright filters, repository sensitivity tiering, vetting workflows for IDE extensions and MCP servers, PR accountability rules, and adoption/quality telemetry are worked through using concrete policy templates.
Who Should Attend?
- Engineering directors, CTO office and software development managers
- Application Security (AppSec), Information Security (CISO) and IT governance teams
- Platform/DevEx leads and technology legal/compliance specialists
- Prerequisite: familiarity with enterprise software delivery and security/compliance concepts
Key Takeaways
- Classify repositories by sensitivity and criticality to define permitted AI usage tiers
- Specify Zero Data Retention (ZDR), private endpoint and VPC hosting requirements for coding models
- Define clear engineer and reviewer accountability rules for AI-assisted pull requests
- Establish a vetting and allowlisting process for IDE plugins, CLI agents and MCP servers
- Deliver an actionable AI coding policy aligned with KVKK/GDPR, ISO/IEC 42001 and EU AI Act expectations
Curriculum
Shadow AI Risks and Policy Design Framework
- Source-code leakage, prompt logs, model training opt-outs and telemetry risks
- Designing paved-road policies that channel developers to safe defaults
Data Privacy, Network Isolation and Context Exclusions
- Zero Data Retention (ZDR), enterprise AI gateways and private VPC deployments
- Enforcing
.cursorignore, Copilot content exclusions and secret filtering
Intellectual Property, Open-Source Licences and Indemnification
- Public-code duplication filters and preventing copyleft (GPL/AGPL) contamination
- Evaluating vendor IP indemnification clauses and code ownership terms
Governance for Tools, Extensions and MCP Servers
- Security vetting and allowlists for IDE extensions, model providers and MCP servers
- Command execution and network permission policies on developer machines and CI
Developer Accountability, Rollout and Compliance Audits
- Translating 'human accountability for every committed line' into concrete PR gates
- Backing policy documents with technical guardrails and an audit checklist
Other Courses in This Category
-
End-to-end training on redesigning the Software Development Life Cycle for the AI era—resolving review, QA and security bottlenecks across requirements, coding, PR review, CI/CD and operations, with DORA/SPACE metrics.
- Live Course
- 5 modules
-
Extracting business rules from COBOL, PL/SQL stored procedures and legacy Java/.NET monoliths, applying the Strangler Fig pattern, verifying parity with golden-master/dual-run tests and migrating safely to modern architectures.
- Live Course
- 5 modules
-
Training for QA and test engineers on testing non-deterministic LLM, RAG and agent applications using golden datasets, RAG evaluation metrics, LLM-as-a-Judge, prompt-injection red teaming and CI regression gates.
- Live Course
- 5 modules
-
Training for SRE, DevOps and IT operations teams on alert noise reduction, log/metric/OpenTelemetry trace correlation, recent-change analysis, human-approved runbook execution and post-mortem automation.
- Live Course
- 5 modules
-
Accelerated transition programme taking software teams from basic IDE autocomplete and chat to context engineering, multi-file editing and test-verified autonomous coding agent workflows.
- Live Course
- 4 modules
-
Hands-on training on designing modular, path-scoped and testable AGENTS.md, CLAUDE.md, .cursor/rules and .github/copilot-instructions.md files so coding agents consistently follow team architecture and standards.
- Live Course
- 5 modules
Get in touch
