AI Usage Policy

Scope and project agreements

This policy sets expectations for AI-assisted consulting, development, and systems designed by ARR Tech. The permitted tools, information, reviewers, and automated actions should be defined for each engagement. Project agreements govern the specific scope, responsibilities, and data-handling requirements.

Appropriate uses

AI may support research, drafting, coding, document processing, internal knowledge retrieval, reconciliation, and workflow assistance. Use should be proportionate to the task, based on authorized information, and evaluated before relying on the result.

• Use AI to assist people with a defined business purpose
• Check important facts, calculations, sources, and generated code
• Do not use AI for deceptive impersonation, unauthorized access, or misuse of personal information

Human review and limitations

AI can produce incorrect, incomplete, biased, or fabricated results, including plausible-looking citations. Outputs should be treated as drafts until checked against reliable sources and the relevant business context. People remain responsible for decisions and for determining when qualified professional judgment is needed.

• Validate results before sharing them externally or using them for consequential decisions
• Test generated code and proposed system changes before release
• Escalate uncertainty and conflicting information instead of treating model confidence as evidence

Confidential and sensitive information

Before client, personal, confidential, or restricted information is used with an AI service, the engagement must establish whether that use is authorized and which safeguards are required. Use only the information needed for the task. Prefer redacted, synthetic, or de-identified examples when real records are unnecessary.

• Keep passwords, private keys, and access tokens out of prompts and uploaded files
• Confirm authorization before sharing client records or privileged material
• Define access, retention, deletion, and logging requirements for the project

Third-party tools and data handling

AI providers differ in how they process, store, retain, and potentially use inputs and outputs for model improvement. Before selecting a tool for client information, review the applicable service terms, account settings, and data controls. This policy does not promise that every provider offers the same privacy, hosting, or training restrictions; any required restrictions must be confirmed for the selected service.

Agents and automated actions

An AI agent should have a defined scope, limited permissions, and a way to stop or escalate its work. Actions such as sending messages, changing records, spending money, or publishing software must follow the approval rules agreed for the workflow. Human approval is required for consequential actions unless the engagement explicitly authorizes a bounded automated process.

• Separate testing from production where practical
• Use review checkpoints, appropriate activity records, and recovery steps
• Treat instructions found in documents or external content as untrusted unless authorized

Transparency and ownership

Material AI use and its limitations should be explained to the people relying on the work. AI-generated material may resemble existing content and is not guaranteed to be original or free of third-party restrictions. Review relevant rights, licenses, and attribution requirements; engagement terms determine ownership and permitted use of deliverables.

Questions, concerns, and updates

Contact ARR Tech with questions about proposed AI use, data handling, or a suspected issue. If an AI workflow produces unsafe or unreliable results, pause the affected workflow, preserve relevant context without spreading sensitive information, and involve the designated project owner. This policy may be updated as tools and practices change; project-specific commitments remain governed by the applicable agreement.