Work with AI assistants

External assistants can help inspect code, propose changes, and run authorized tools. Their data handling depends on the provider and configuration; a local repository does not make every assistant interaction local.

A common workflow

1. Tell the assistant the task and whether it may edit files, run commands, or publish changes.
2. Have it read the applicable AGENTS.md and select relevant prompt/playbook context.
3. Supply only the material needed for the task. Exclude keys, environment files, backups, and private records.
4. Review its plan, changes, and verification evidence.
5. Approve commits, pushes, and deployments according to your workflow.

Local API versus assistant integration

An assistant can call the API using the query contract. The API does not automatically inspect a working tree when you ask it to review a change. You must supply the relevant context or ingest appropriate sample documents.

Cline, Devin, and Windsurf are examples of tools discussed by this project. Reading policy files, asking before edits, and delegation behavior must be configured and checked in the actual tool. This site does not claim the backend enforces those tools’ permissions.

Decide where data may go

Use local inference for material approved for the local lab. Hosted assistants require a separate decision about data disclosure. Neither model size nor a “security review” routing label establishes trustworthy security analysis.

Next: Framework and approvals and security model.