Security and sensitivity classification
AI coding tools support different classification and sensitivity levels. Use this page to determine the right tool for your project.
Before you begin
Before selecting an AI coding tool, complete the following steps:
Classify your code and data — This includes source code as well as any associated data (e.g. Jira tickets, Confluence pages, documentation, configurations). See Code Classification Overview to determine your classification.
Obtain Agency CIO approval — Your agency Chief Information Officer (CIO) must approve your Classification before you proceed.
- Classification applies to Government-owned source code and associated data, including content developed or maintained by vendors and contractors.
- Review your Classification after major code changes or as part of your agency’s periodic review cycle.
Once your Classification and Sensitivity have been approved, use the following tables to determine which AI coding tools you can use.
- Classification refers to Code and Data Classification.
- Sensitivity refers to Data Sensitivity.
Tools for WOG users
| Classification up to ¹ | Sensitivity up to ¹ | Supported tools |
|---|---|---|
| OFFICIAL (CLOSED) | Sensitive-Normal | - Prelude (Code review) |
| RESTRICTED | Sensitive-Normal | - Claude Code (Agentic) - GitHub Copilot (Agentic, non-agentic) |
| CONFIDENTIAL (CLOUD-ELIGIBLE) | Sensitive-Normal | Tools under evaluation. C(CE) support is still being assessed and will be made available when ready. If you have suggestions or specific requests, contact SHIP-HATS. |
Tools for GovTech users
| Classification up to ¹ | Sensitivity up to ¹ | Supported tools |
|---|---|---|
| OFFICIAL (CLOSED) | Sensitive-Normal | - Cursor (Agentic) |
| RESTRICTED | Sensitive-Normal | - Claude Code (Agentic) - GitHub Copilot (Agentic, non-agentic) - Prelude (Code review) |
| CONFIDENTIAL (CLOUD-ELIGIBLE) | Sensitive-Normal | Tools under evaluation. C(CE) support is still being assessed and will be made available when ready. If you have suggestions or specific requests, contact SHIP-HATS. |
💡 For tool availability by organisation and user type, see AI coding tools.
¹ Tools approved for higher Classification or Sensitivity levels can also be used for lower Classification or Sensitivity levels.
Additional approvals
Before using agentic AI coding tools, determine whether your system requires additional clearance.
If your system is classified as Critical Information Infrastructure (CII) or Significant Information Infrastructure (SII), you must obtain system-level approval before using agentic AI tools, even if the tools are approved by GovTech.
| System | Action |
|---|---|
| CII | Perform a risk assessment and seek clearance from CSA as part of the CCoP process |
| SII | Perform a risk assessment and seek clearance from your agency’s IDSC |
⚠️ SHIP-HATS tool clearance alone is not sufficient for CII/SII systems.
💡 Not sure if your system is CII or SII? Consult your ACISO or MCISO.
