Policy Statement on the Use of AI Vibe Coding Technology

What is Voice Cloning?

Vibe coding is the practice of using AI tools (e.g. Claude, Copilot, ChatGPT, Gemini, Base44 or similar low-code generators) to create:

• Software
• Automations
• Integrations
• Data processes

…using natural language prompts without formal engineering design, validation, or oversight.

Vibe coding is conversing with AI so that instead of generating an answer, response, or image, it generates code or even a functioning app or website. The nuances and expertise required to code securely and think like an engineer or developer should be embedded within the finished product. However, these are rarely present in a vibe-coded solution unless explicitly and expertly instructed by the user to the tool.

As a result, a vibe-coded solution is effectively a black box of unknowns, where risks are hidden and controls are not understood. People must not stray beyond their professional expertise when using AI in this way.

AI Ethical Framework Alignment

Vibe coding by non-developers directly conflicts with the following SSAFA principles:

• Security & Privacy → Risk of exposing sensitive beneficiary data
• Accountability → No clear ownership or support model
• Accuracy & Reliability → Outputs are untested and may fail silently or run up costs due to the way the tool interpreted commands
• Transparency → Logic and decision-making are not understood and the exact underlying code absent from documentation
• Governance & Oversight → Controls, approvals, and audit trails are bypassed

For this reason, vibe coding is classified as a red line activity.

Policy

Vibe coding is strictly prohibited for anyone who is not:

• A professional developer
• An API/integration specialist
• A systems engineer
• An authorised member of the IT/Data team

All AI-assisted system creation must operate under:

• Formal design standards
• Security review
• IT governance and change control

In line with the AI Ethical Framework, non-developers may use AI tools for:

• Drafting
• Research
• Ideation
• Learning

They must not use AI to:

• Build or deploy systems
• Create automations or integrations
• Modify structured data at scale

Review

This policy will be reviewed annually or sooner if regulatory or technological developments require.