checklist

Developer AI tool inventory template

A practical inventory template for small engineering teams tracking AI coding tools, agents, IDE extensions, repository access, data exposure, and approval status.

Bottom line

Small teams should keep a simple inventory of every AI coding tool that can see source code, repository metadata, tickets, terminal output, logs, screenshots, browser pages, or pull requests. Without an inventory, the team cannot answer basic security questions: who approved the tool, what code it can access, whether it can run commands, where prompts may go, and who should remove access when a developer leaves.

Use this rule:

No AI coding tool gets production-adjacent access until it has an owner, scope, data classification, approval status, and review date.

Start by running the AI Tool Risk Checker for each tool category, then store the resulting decision in the Small Team AI Security Checklist. For agentic coding tools, pair this template with the terminal command approval playbook and the AI code review policy.

Inventory template

Copy this table into a spreadsheet, Notion database, Linear issue, or GitHub project. Keep it short enough that someone updates it.

Field	Example	Why it matters
Tool name	Cursor Team, GitHub Copilot Business, Claude Code, Codex, Continue, Tabnine	Avoid unmanaged personal tools hiding in developer workflows.
Tool type	IDE assistant, coding agent, code review assistant, CLI agent, browser extension, MCP server	Different tool types expose different data and command paths.
Owner	Engineering lead or security owner	Someone must own approval, renewal, incident response, and offboarding.
Users / seats	3 backend engineers	Identifies who needs policy training and offboarding.
Account type	Team/business, enterprise, personal, trial	Personal accounts often have weaker admin and data controls.
Repositories allowed	Public docs repo, internal API repo, no production infra repo	Sets the boundary for source-code exposure.
Data allowed	Public code, internal code, no customer data, no secrets	Prevents accidental prompt or context exposure.
Agent capability	Read only, edit files, run commands, open PRs, browse web	Raises review and command-control requirements.
Terminal access	None, ask before command, unrestricted, cloud sandbox	Terminal access is a major risk tier.
Network access	None, package registries only, allowlisted, unrestricted	Network access affects exfiltration and supply-chain risk.
Admin controls	SSO, SCIM, roles, audit logs, policy controls, privacy mode	Confirms whether the tool can be governed centrally.
Evidence links	Vendor security docs, data-use policy, admin docs	Keeps the approval decision grounded in current documentation.
Approval status	Approved, pilot, restricted, blocked, needs review	Makes it clear what developers may use today.
Review date	2026-06-27	Forces periodic review as AI tools change quickly.
Notes	Do not use with customer logs; command approval required	Captures practical team-specific rules.

Approval status rules

Status	Meaning	Allowed use
Approved	Reviewed and accepted for named repositories and users.	Use within the documented scope.
Pilot	Limited test with owner, end date, and review criteria.	Use only by named users and repositories.
Restricted	Allowed only for low-risk workflows or non-sensitive code.	Use with extra controls or narrower data boundaries.
Blocked	Not allowed for company code or company data.	Do not use with work content.
Needs review	Discovered or requested, but not assessed yet.	Do not expand until owner approves.

First 30-minute inventory

Run this lightweight process before trying to make the inventory perfect.

• List every AI coding assistant, IDE extension, CLI agent, code review tool, browser extension, and MCP server developers use.
• Mark whether each tool uses personal or managed accounts.
• Mark whether each tool can see private repositories.
• Mark whether each tool can edit files or run commands.
• Mark whether each tool can reach the internet or package registries.
• Mark whether it can access customer tickets, production logs, screenshots, or docs.
• Mark whether the vendor has security, privacy, and data-use documentation.
• Assign an owner and review date for every tool.
• Block any tool with no owner and private-code access.

Minimum approval record

Use this short record when a developer asks to add a new AI coding tool.

Developer AI tool approval

Tool:
Requested by:
Owner:
Use case:
Tool type:
Account type:
Repositories:
Data allowed:
Data prohibited:
Agent capabilities:
Terminal access:
Network access:
Admin controls:
Evidence reviewed:
Approval status:
Review date:
Required safeguards:

Evidence checked

• NIST’s AI Risk Management Framework frames AI governance around mapping, measuring, managing, and governing AI risk. An inventory supports the “map” and governance work.
• NIST’s Secure Software Development Framework SP 800-218 supports maintaining secure development practices and understanding tools and components in the software lifecycle.
• CISA’s Secure by Design guidance supports designing security into software and reducing risk before products reach users.
• OWASP’s AI Maturity Assessment and AI Security and Privacy Guide are useful references for AI governance, data handling, and assurance questions.
• Cybergiz’s AI coding production incident risk playbook, AI agent terminal approval playbook, and AI code review policy define the practical controls this inventory should connect to.

Review cadence

Cadence	What to review
Weekly during pilot	New tools, unknown personal accounts, command history, AI-authored PR quality, and blocked tool requests.
Monthly after rollout	Approval status, user list, repository scope, vendor documentation changes, and review dates.
On employee exit	Remove seats, revoke tokens, remove IDE/plugin access, check connected GitHub/GitLab apps, and archive relevant approval notes.
On incident or near miss	Reclassify the tool, review prompts/context, command logs, PRs, repository access, and vendor controls.

FAQ

Is a spreadsheet enough?

Yes for a small team. The inventory is useful only if it stays current. A simple spreadsheet with an owner and review date beats a complex system nobody updates.

Should personal AI coding accounts be allowed?

Not for private company code by default. Personal accounts are harder to govern, offboard, audit, and configure consistently. Use managed business/team accounts for company source code.

Do we need to inventory browser extensions too?

Yes. AI browser extensions and IDE extensions may see pages, code, prompts, tickets, or docs. Add them if they touch engineering work or developer context.

What is the first tool to block?

Block any AI tool that has private repository access, no owner, no data-use evidence, and no clear account management. Move it to “Needs review” or “Blocked” until someone owns the decision.

How does this connect to policy?

The inventory is the source of truth. The policy says what is allowed; the inventory records which tools are approved, for whom, and under what safeguards.