Quick Reference

The one-page version. The full policy governs.

The three rules

1. Synthetic or public data only. No lab or Institute data goes into an AI tool, ever.
2. Review before it runs. No auto-approve. Read every command and every diff.
3. You own the output. If you didn't write it, you must review it.

Green light

• Writing, refactoring, debugging and documenting your own code
• Working against a synthetic dataset that mirrors your real schema
• Explaining unfamiliar code, packages, or methods to you
• Public/openly licensed reference data, where the licence permits
• Literature triage, drafting, and editing your own text
• Boilerplate: plotting code, argument parsing, tests, Nextflow scaffolding

Red light

• Any individual-level cohort data — lipidomics, genotypes, phenotypes, clinical, linkage
• Restricted derived data: summary statistics or aggregates from controlled datasets
• Participant identifiers of any kind, including dates and site records
• Credentials: keys, tokens, .env, service account JSON
• Unpublished collaborator code, or commercially sensitive code
• Unpublished IP, novel hypotheses, or sensitive grant text (unless using Baker's Microsoft Copilot)
• Manuscripts, grants, or other materials provided for peer review (including from collaborators)
• Pointing an agent at a directory or drive containing real data
• Auto-approve / YOLO mode / "always allow" on lab systems

Before you let an agent run

• Working directory contains no real data
• Work is committed, so I can see and revert the diff
• Ensure you opt-out of improving models (your prompts are not used for training) in your personal account settings, or use Baker's enterprise Microsoft Copilot
• Auto-approve is off
• No credentials in the environment or context
• I have read the command / diff and I understand it

Before you accept generated code or text

• I can explain every line of code
• Every package and function it used actually exists and does what it claims
• It is right, not merely running without error
• I have checked that any and all generated references are strictly accurate and genuinely support my claims, not just that they exist
• I have declared the use of AI tools in the manuscript/thesis (LLMs cannot be authors)

If something goes wrong

Tell the lab head the same day. Preserve the logs. Don't quietly clean it up.

No penalty for reporting promptly. Serious consequences for concealing.

The habit worth building

Build synthetic data once and place it in the Resources folder for re-use. Develop against it with the tool. Run against the real data yourself, tool detached, in the approved environment.

One hour of setup buys you the tools without any of the risk.