handbook: allow scoped credentials for AI agents under review

nuxt/content/handbook/company/security/ai-development-and-customer-data.md

@@ -40,7 +40,14 @@ When using AI internally:
 2. Use internal, synthetic, or publicly available data for experimentation whenever possible.
 3. Review AI-generated output before relying on it or including it in the product.
 4. Do not use AI tools to bypass security controls, access restrictions, or approval processes.
-5. Never give credentials to AI tools or agents. This covers Personal Access Tokens, API keys, passwords, and any other secret, whether you're pasting it into a chat or handing it to an agent to act with. Admin-scoped FlowFuse Cloud and Dedicated Instance PATs are the highest-risk case: an agent holding one can take destructive, account-wide actions.
+5. Credentials may be given to an AI tool or agent where the work genuinely needs it, provided all of the following hold:
+   - **Discuss it first.** Talk the use case through with at least one other team member before you create or share the credential. If you cannot explain to a colleague what the agent will do and why it needs this access, that is your answer.
+   - **Document the discussion.** Record who you spoke to, what the agent will be doing, the scope granted, and when the credential will be revoked. Open an [Access / Permission Request](https://github.com/FlowFuse/admin/issues/new?template=access-request.md) issue in the admin repo on GitHub, the same place other access decisions are recorded. A verbal or DM conversation nobody can find later does not count.
+   - **Scope it to the job.** Grant the narrowest access that makes the task possible. For a FlowFuse Personal Access Token, that means scoping it to the single team you are working in, not your whole account.
+   - **Read only by default.** Only grant write access where the task genuinely cannot be done without it.
+   - **Rotate and revoke.** Treat any credential an agent has held as spent. Revoke it as soon as the work it was created for is finished, and do not carry it over to the next task. Where a credential must persist, rotate it on the schedule set out in the [Access Control Policy](./access-control.md), at minimum annually, and sooner if the agent, tool, or vendor changes. Revoke immediately if you suspect it has been logged, cached, or otherwise exposed.
+   - **Never admin-scoped.** Admin-scoped FlowFuse Cloud and Dedicated Instance PATs are the highest-risk case: an agent holding one can take destructive, account-wide actions. That is never the minimum an individual task needs.
+   - Passwords, and any other secret that cannot be scoped or revoked, are still not to be shared with AI tools.
 
 Apply the same data protection, security, and review standards to internal AI usage as to AI functionality shipped within the product.