Introducing AI to an Existing Codebase
Unlike a new project, when introducing AI to a long-operated codebase, guardrail design is important. Deciding what to delegate and what to forbid first is the key to preventing incidents.
Pre-Introduction Risk Assessment
1. Code Confidentiality
- Trade secrets, competitive-advantage core: confirm internal rules before sending to AI
- Code with personal info/customer data: masking required
- Config with API keys/credentials: exclusion setting required
2. Size of Impact
- Production-direct code: high risk, human review required
- Tests/utilities: low risk, more freedom
- Migrations: medium risk, rollback plan required
3-Stage Guardrails
1. Scope Limitation
State directories AI may edit. Specify out-of-scope with .cursorignore / .copilotignore.
# .cursorignore secrets/ node_modules/ dist/ *.env production-config/
2. Action Limitation
- Permission mode: "always confirm before executing" setting
- Delete operations: not allowed without explicit approval
- git operations: commit / push by humans
3. Quality Gates
- Mandatory Lint/Format pass
- Maintain test coverage
- Security scan in CI
- Human check in PR review
Gradual Introduction Roadmap
Week 1: Completion Only
Only turn ON Copilot/Cursor Tab completion. Get used to AI without changing how you write.
Week 2: Question Feature
Only questions like "explain this code," "write tests," no new generation.
Week 3: Single-File Changes
Add new files, rewrite just one function of an existing file. Always review in PR.
Week 4+: Multi-File Changes
Multi-file changes with Cursor Composer or Claude Code. Review strictly.
Project Documentation
Make the project easy for AI to understand:
- README: project purpose/architecture overview
- CLAUDE.md / AGENTS.md: instruction sheet for AI
- README of main directories: each module's role
- API documentation: endpoint specs
- Rich type definitions: strict for TypeScript
Test Strategy
- Enrich tests before introduction: guarantee nothing broke after AI changes
- Golden Set: define tests that absolutely must pass
- Coverage target: maintain after AI changes
Review Policy
How to Look at AI-Generated Code
- Don't OK it on "it runs" alone
- Confirm intent and implementation match
- Eliminate wasteful changes (over-refactoring)
- APIs/libraries you haven't used need verification
Review Lenses
- Security: authn/authz, SQL injection
- Performance: N+1, large-data processing
- Error handling: failure behavior
- Tests: covered cases
- Naming/style: project-convention compliance
Incident Cases and Measures
- API key included in a PR change → strengthen .gitignore, pre-PR grep
- Arbitrary upgrade of old dependency → package.json changes need approval
- Committed with broken tests → always block in CI
- Unauthorized library addition → dependency additions need approval
Organizational Operation
- Unify AI-tool selection organizationally
- Privacy Mode / Business plan subscription
- Periodic AI-use guideline updates
- Share AI-related incidents
Next Step
How to write coding prompts is in the next article.
