# Session Records Policy

**Template · hxframework.org/policy · CC BY 4.0 — adapt freely.**
**This is a template, not legal advice. Review with counsel before adoption.**

*Replace [Company] throughout. Sections marked (adapt) are the ones organizations most often tailor.*

---

## 1 · Purpose

Working with AI agents produces a record: the sessions in which requirements are clarified, approaches are weighed, and the reasoning behind our code and decisions is written down. This record is valuable to [Company] — it is how we learn from our own work — and it is sensitive to the people who create it. This policy states how it is kept, who can see it, and what it will never be used for.

## 2 · Scope

This policy covers AI agent sessions conducted **in [Company] repositories, on [Company] accounts, in the course of work**.

It does not cover personal projects on personal accounts and personal machines. The collection boundary is the repository connection, not the device: if a folder is not wired to a [Company] repository, nothing in it is collected. (adapt: name the tools and the connection mechanism you use.)

## 3 · Custody

Session records within scope are [Company] work product — the same category as the code they produce. [Company] keeps them: preserved, backed up, and retained like source code, so the record survives laptop failures and tool changes.

## 4 · Visibility

Custody is not visibility. Ownership of the record is not a license to read it.

- A raw session is readable by its **author**.
- It becomes readable by others **only** when all four of the following are true: (1) it was recorded in a work repository; (2) that repository is connected to a project in [Company]'s workspace; (3) a named team has been granted that project; (4) the author has approved a share request, scoped to that team. Approval is revocable; requests and approvals are logged.
- Everyone else — including managers and administrators — sees **aggregates only**: groups of five or more, with trend and group size attached.

## 5 · Coaching

Where AI coaching is offered, it exists for the person being coached. Coach conversations, quiz results, and self-assessments reach the person and their coach — never a dashboard, never a manager, never a performance file.

## 6 · What these records are never used for

Session records and experience signals exist to improve the system of work. They are **not** inputs to decisions about an individual's performance, compensation, or employment. Those decisions are made with [Company]'s other instruments. (adapt: name those instruments if your handbook lists them.)

## 7 · The access log

Every access to data that includes a person is logged, and that person can read the log of access concerning them.

## 8 · When someone leaves

When someone leaves [Company], the record stays — it is work product. Nothing else changes: their raw sessions remain closed to individual reading under the same rules as before.

## 9 · Changes to this policy

This policy is versioned and displayed where the measurement happens. Changes are announced to everyone before they take effect, and previous versions remain available.

---

*Signed for [Company]: ______________________  Date: ____________*

*Based on the CARE Charter (hxframework.org/charter). Published under CC BY 4.0.*