AI ATELIER
The data, permissions and review decisions to settle before AI touches a live project. These are proposed controls; exact deployment arrangements are agreed per engagement.
AI proposes. AI executes approved tasks. AI checks. The designer decides.
Before a pilot, map which files go to which provider, region and service. Hosting the website in one location does not establish where an AI provider processes project data. Provider, contract and residency choices are confirmed per engagement.
Use approved source sets and separate project contexts. Exclude confidential client material from demonstrations unless the owner has authorised its use and redaction has been reviewed. No public LAB entry should expose live credentials or identifiable client records.
A modelling role should not inherit email, procurement or unrelated file access. Define read, write and execute rights separately. The integration must enforce those rights; a prompt asking an agent to behave is not an access control.
Identify the reviewer, approved revision, changed objects, source inputs and executed rules. External messages, purchases and changes to production files require an explicit policy and the appropriate approval.
Agree what becomes project memory, how long each record is kept and who may delete it. Retention must cover logs, indexes, exports, backups and provider-side records where applicable. Exact periods and deletion procedures are set in the project agreement.
Plan how to disable a connection, revoke credentials, stop scheduled work and restore the last approved revision. A failed or cancelled run must remain distinguishable from a completed run with no changes.
Checks have defined scope and assumptions. An agent’s summary is not architectural, engineering or regulatory approval. Qualified professionals retain the decisions and responsibilities that belong to their role.