How do you let AI agents write code without putting personal data at risk?
AI agents can write most of the code in a codebase that handles personal data, if three things are in place: the agents never work against production data, the security requirements (row-level security, the access model, forbidden patterns) are written into the agents' instructions and backed by automated checks, and every change is reviewed automatically for security and database defects before a person approves it. What usually goes wrong is not the model, but that nobody wrote down what it must not do. Below are the controls we set up, and what to ask of anyone who builds for you.
The controls
No production data within the agents' reach
Agents work against synthetic or truly anonymised staging data; masked or pseudonymised data still counts as personal data. Production credentials stay in your vault and never reach the environment the agents run in.
Security requirements in the agents' rules
Row-level security, the access model and forbidden patterns are written into the rules file the agents work from, and automated checks back them up, so the requirement is in the instructions and in CI, not only in someone's head.
Review agents before a human looks
Every pull request is checked for security, database and performance defects. Findings block the merge until they are fixed.
People merge schema changes
Agents can write and test a migration, but a person reviews and merges it, with a plan for rolling back.
Prompts and logs without personal data
Personal data is kept out of prompts and agent logs, and the AI vendor is covered by a data processing agreement.
What to ask anyone who builds for you
Five questions that separate a controlled setup from a demo.
Where do the agents run, and what can they reach?
The answer should name the environment and rule out production data and production credentials.
Which rules do the agents follow, and where are they written?
Ask to see the rules file. If the security constraints aren't in it, the agents don't know them.
What reviews every pull request before a person does?
Look for automated review of security and database changes, not only tests that pass.
Who merges migrations and changes to access control?
The answer should be a named person, not an agent.
What happens to the prompts and logs?
They should be free of personal data, and the AI vendor should be covered by a data processing agreement.
What a catch looks like
Say an agent adds a new table for a feature and forgets row-level security. The review agent flags the missing policy on the pull request, the agent adds it, and a CI check confirms that every table has row-level security enabled before anything can merge. Nobody has to spot it by hand.
Questions
- Is it safe to let AI write code in a codebase with personal data?
- It can be, if the agents never touch production data, the security rules are written down and enforced in review, and a person approves every merge. The risk sits in missing guardrails more than in the model itself.
- Does the AI vendor see our customers' personal data?
- Only if it is sent to them. We set agents up to work on code and synthetic data, keep personal data out of prompts and logs, and check that the AI vendor is covered by a data processing agreement.
- What is row-level security, and why does it matter for AI-written code?
- Row-level security lets the database decide which rows each user may read or change. It matters because an agent writing a new query or table can easily skip an access check; with row-level security in place, the database still refuses. But a new table has none until someone enables it, and admin or service-role connections bypass it, so both need a check in CI.
- Do we need a DPIA for AI-assisted development?
- If no personal data is processed in the development work itself, the DPIA question doesn't arise for it. AI features in your product that process personal data may need one; our checklist lists the criteria. The assessment is yours to make as the controller, with advice from your data protection officer if you have one.
Want this set up in your codebase?
Start with a free 30-minute intro call. We'll look at your repos and tell you honestly where to begin.
Book intro call