Audience and process

We developed this guide for members of the environmental science community who use GenAI or are curious about using GenAI to write code and conduct data analyses while maintaining a high level of scientific rigor in their work. We all have backgrounds in various domains of environmental science and code on a regular basis, but we use GenAI to varying degrees (rarely to daily). Through a series of facilitated discussions, we identified important lessons learned through our own use of GenAI and subsequently streamlined these into 10 rules. We refined these rules through literature review and co-writing. Given the rapid development of research on GenAI, we frequently include references to pre-print articles and non-peer-reviewed material, such as reports or news articles, to provide timely perspectives on this topic. Our use of these sources should not unduly impact the key points of our narrative because rules were developed through direct user experience.

These rules focus on technical considerations and practices specific to GenAI use, especially where it creates novel challenges or requires new approaches, rather than broader best practices related to scientific rigor, open science, or coding. The rules further assume that an individual has determined that GenAI use is both appropriate and allowable for the identified task and do not describe the ethical considerations underlying that decision. Guidance on the ethical use of GenAI represents an active and complementary area for future research that requires interdisciplinary expertise beyond the scope of this paper [15]. However, we do discuss potential consequences of GenAI use that should be considered to avoid perpetuating social and environmental inequities.

Rule 1. Understand your domain (or take the time to learn it)

Effective use of GenAI tools requires understanding a task well enough to clearly articulate it, which draws on both subject matter expertise and knowledge of appropriate methods. When users lack the necessary expertise, they should make a deliberate effort to build it or collaborate with subject matter experts to ensure they can guide GenAI toward correct implementations. The risks of using GenAI without this foundation range from relatively innocuous time wasting seen in junior programmers [23] to substantial methodological errors that influence critical decisions [24]. For example, subtle analytical choices made in ecological modeling (e.g., species distribution modeling), data analysis and bioinformatics pipelines, and data cleaning can alter conclusions and lead to incorrect inferences [25–29]. Left undetected, those mistakes could carry serious consequences for end users. Notably, GenAI can help motivated users identify and fill in knowledge gaps to prevent such consequences (e.g., breaking down complex topics, creating study guides [30]).

Rule 2. Use a GenAI tool tailored to your task

Selecting the right GenAI coding tool requires matching its capabilities to the security needs, scale, and complexity of your work. If tasks involve sensitive data, proprietary code, or other legal considerations, private or self-hosted tools that do not transmit inputs to external servers may be needed. Beyond that constraint, different GenAI tools have strengths and limitations that may suit different project stages. For instance, general-purpose chatbot interfaces, such as ChatGPT [18] and Google Gemini [19], may serve early ideation (e.g., brainstorming analysis strategies) and provide simple coding assistance (e.g., explaining unfamiliar error messages, drafting pseudocode). With more code-intensive tasks, using platforms with built-in GenAI agents (e.g., Posit AI within Positron [31]) provides a familiar coding interface while adding access to more advanced GenAI assistance. As project complexity grows, AI-native IDEs, such as Cursor [20], Devin Desktop (formerly Windsurf) [32], or GitHub Copilot [33], become increasingly valuable. Thanks to their ability to draw from an entire codebase, they provide context-aware code completion, multi-file edits, and inline chat grounded in your actual project files, which helps with tasks such as automated refactoring and bug fixing [34–36]. In all cases, the specific model used (e.g., Gemini 3.5, GPT-5) also influences performance, as models vary in the size of their context window, speed of analysis, and resource usage [37]. Because the GenAI landscape is evolving rapidly, the tools named here reflect the state of the field at the time of writing; the enduring principle is to match the tool to the task, not to adopt any particular product.

Rule 3. Set up your GenAI platform for your task

Deliberate setup of GenAI tools for a specific task improves their performance and efficiency [38] and streamlines communication between you and the AI tool [39]. Describing the goals and providing background information (e.g., the problem setting, data, constraints, and desired output) improves the consistency and reliability of generated output (see Broderick [40] for an example setup). Depending on the complexity of the task and capabilities of the GenAI tool, the necessary setup can vary substantially. For beginner users, setup may be as simple as creating a reusable project description in a chatbot interface, while more advanced users of GenAI tools may benefit from hierarchical directories of context files for agentic workflows. Users should carefully consider what to include in context to ensure security of sensitive information (e.g., through .ignore files). Proper customization can also heighten reproducibility and transparency of analysis pipelines and complicated code bases when setup files encapsulate the appropriate background information.

Rule 4. Give GenAI tools only as much access as needed

The use of AI agents can introduce significant risks because these agents often inherit the same permissions and system access as the user and have been observed to enact adversarial and unexpected behaviors [41,42]. Some recommended practices to minimize risks include: running agents within isolated environments (e.g., virtual machines, containers, or dedicated systems), enforcing restricted permissions (such as through separate non-administrative user accounts), and ensuring secure, authenticated interactions with external tools and resources [43]. Importantly, these practices have restrictions enforced by the system surrounding the AI, rather than relying on the model itself, since language models are unreliable security gatekeepers [44]. Underlying these recommendations is the security principle of least privilege: an AI system should be granted the minimum access necessary. When in doubt, start with the most restrictive access that still allows the task to be completed, and expand only as needed.

Rule 5. Adhere to principles of data privacy and security

GenAI usage complicates data confidentiality and carries leakage risk that users may underestimate [45]. Under standard consumer accounts, user prompts and outputs may be retained and incorporated into AI training pipelines, creating potential exposure [46,47]. Even where contractual agreements contain data in a controlled institutional ecosystem, prompts and outputs can be subject to legal discovery [48]. Several measures can reduce exposure, including the use of anonymized data, deployment of local GenAI models (e.g., LLaMA), and restricting access to sensitive data and folders (e.g., password protection). Users of GenAI should pay particular attention to these measures when working with sensitive or private data, such as those from Indigenous communities [49]. Ultimately, users bear the responsibility to uphold rigorous privacy and security standards.

Rule 6. Manage long GenAI conversations

Long GenAI conversations that use more of a model’s available context window degrade model accuracy, a phenomenon known as “context rot” [50,51]. This happens because the self-attention mechanism that governs the model becomes less reliable as the number of tokens increases, raising the risk of “hallucinations”. Mitigation techniques to maintain accuracy include keeping chats short and focused and initiating new chats or sessions following changes in tasks and scope. For long-horizon tasks, compaction (i.e., condensing information size while maintaining key details from context), structured note-taking, and multi-agent architectures can help manage context effectively [52].

Rule 7. Verify and validate GenAI output

GenAI tools can both introduce and catch errors in code, which makes deliberate validation practices essential. Code produced by GenAI tools may execute cleanly but incorrectly [53], so users should verify outputs at multiple stages to catch issues early. Appropriate validation may include checking that data is read in accurately, testing edge cases informed by domain expertise, and confirming that intermediate results align with expectations. GenAI can accelerate this process: cross-model review (e.g., writing in one tool, reviewing in another) provides an independent check, while requesting on-demand visualizations or summary tables can surface problems that are hard to catch by reading code alone. GenAI also lowers the barrier to follow good coding practices that support validation [54,55], such as modular code with discrete, testable steps and well-annotated functions [56].

Rule 8. Document your process

GenAI usage can obscure the decision-making process behind an analysis when key assumptions, decision pathways, and iterative refinements live only in chat histories that are difficult to trace and may be lost entirely. To counter this risk, users should document critical decisions directly in their code base through comments, README files, or version-controlled decision logs, akin to lab notebooks in experimental fields, ensuring that the reasoning behind analytical choices is preserved independently of any GenAI tool. In fact, GenAI can assist in this process by logging key decisions and justifications and saving these, such as in a markdown (.md) file. Configuration files that shape the behavior of GenAI, including system prompts, custom instructions, or project knowledge files, can also be version controlled and shared in repositories as part of the analytical record and to help others build on the user’s approach. When chat histories contain critical information not captured elsewhere, saving them to local, backed-up storage provides an additional safeguard.

Rule 9. Leverage GenAI to follow best practices

GenAI tools can significantly improve adherence to best practices that people often struggle to maintain consistently, such as thorough documentation, style standardization across multi-contributor code bases, and well-organized data repositories. Tasks that are tedious or time-consuming to do manually, such as annotating functions, flagging hard-coded values, enforcing consistent coding standards, and writing comprehensive metadata, are well-suited to GenAI and can be applied uniformly across an entire project. Per rule 7, all AI-generated content should be reviewed and validated to ensure that it documents the project accurately. The result is cleaner, more auditable, and more reproducible work—not because the standards have changed, but because GenAI dramatically lowers the cost of meeting them.

Rule 10. Prepare for a minimal coding future

Limited coding proficiency has long been a barrier to research in environmental science [57]. GenAI is shifting the bottleneck from programming toward scientific thinking, research design, and methodological rigor. Going forward, the ability to clearly communicate goals, frame problems, and effectively direct GenAI systems may well be more valuable than programming fluency for research productivity [58]. To prepare for this shift, users of GenAI will benefit from a continued focus on foundational skills, including a solid understanding of quantitative methods, data provenance, and research design, along with the ability to articulate scientific intent with precision. These skills are not new demands but fundamental needs to produce robust science efficiently with any tool, including GenAI.

Conclusions

GenAI is a powerful tool, but adopting it effectively for environmental science requires developing new skills and attending to considerations throughout the project that may be unfamiliar to many researchers. As a community, we are navigating a transition into this AI era together: learning, testing, adapting, and improving our skills with these new tools as we go. The 10 rules we present here offer a starting point for that process and complement existing standards that remain crucial to the transparency and rigorous practice of science [57]. When following the rules presented here, coding with GenAI can create rigorous and timely standalone products via transparent, reproducible, and accessible methods that adhere to our community principles. At the same time, organizations and institutions must recognize that without deliberate intervention, the benefits of GenAI may continue to accrue inequitably, maintaining or even widening existing disparities rather than lowering barriers to entry in the field. It is natural to feel skepticism or wariness toward any new tool, and we do not dismiss those concerns. Nevertheless, we have found it highly productive to engage openly with colleagues and explore what works, what does not, and what we do and do not want from these tools. The challenges GenAI poses for our field will not resolve themselves. Meeting them requires the kind of honest, sometimes difficult conversations that move a community forward. Ultimately, we have the power to shape how GenAI integrates into environmental data science, but only if we work proactively and collectively as a community towards that future.

AI use statement

During the development of this manuscript, GenAI tools were used to facilitate writing and synthesis of ideas. Specifically, we used Elicit (https://elicit.com/) for portions of the literature review, Claude Opus 4.6 and OpenAI’s GPT-5.3 mini for editing and revising text. The authors identified the rules without input from GenAI.