Governance for AI Coding Tools

Context

A standard only matters where the work happens. For most of my career that meant documentation: a page someone had to find, read, and choose to follow. The further a standard sat from the moment of building, the less often it won. Most violations weren’t defiance. They were distance.

AI coding tools moved the moment of building. Code now gets generated inside the editor, often by an agent working from a prompt, before anyone reviews it. That’s the worst place for a standard to be missing and the best place for it to be present. Writing it down and hoping gets further from the work exactly as the work speeds up.

The cheapest place to catch a problem is where it’s created. An issue caught at generation is a line that never ships. The same issue caught in review is a comment thread, a rework, and a delay. Caught after launch, it’s a customer problem. The system has to be where the code is written, which means standards have to become something an agent can read and act on, not a document a person has to remember.

The bet

Put the standards in the toolchain. We built an MCP server that loads GoDaddy’s UX and accessibility standards directly into the AI coding tools teams already use. The standard is present while the code is generated, and issues get flagged in place, before review and before a customer sees them.

The bet underneath it: treat this as a product, not a compliance program. Compliance is something done to teams. A product is something they keep using because it makes the work better. If people had to be told to turn it on, we’d already have lost, so it had to earn a place in the workflow: fast, quiet, and right often enough to trust.

You don’t scale a standard by adding reviewers. You scale it by putting it where every build already passes through.

It works for any standard

Nothing about the mechanism is specific to design. A standard is a set of rules a team has agreed to, written so an agent can apply them. UX and accessibility were where we started because they were ours. Legal came next: the same layer now checks legal claims, with coverage live and growing as more get added.

That’s the point it stopped being just a design tool. UX still owns and runs it, but once another function’s standards can be enforced through the same layer, at the point of creation, it’s governance for more than design.

What shipped

A working MCP server, inside the tools people already build with, with real users and a feedback loop:

• 100+ users across engineering, design, product management, and business leadership, using it in their own work, including 90% of GoDaddy’s 130-person UX organization.
• An active Slack channel for feedback and releases. Feedback comes in there, releases go out there, and what gets built next comes from the people using it.
• Three kinds of standards in one layer: design systems, content, and accessibility.

It’s still rolling out: legal was the first set of standards from outside design to run through the layer, and its coverage grows as more get added.

Team

Arnout Kazemier (Principal Engineer), my partner on the project, and Stefan Cirovic (Engineering) carry the build. My part is championing it.