AIArticle Five rust-lang teams will let AI analyze and review code but not author it, with a circuit breaker attached.
Rachel Goldstein Open source projects have spent two years answering the AI-contribution question with one of two blunt instruments: ban it (QEMU, Zig, Servo, postmarketOS, Gentoo) or allow it with disclosure (LLVM, Mesa, Firefox, the Linux kernel). As of today, rust-lang/rust has something more interesting than either. Five teams — compiler, libs, types, rustdoc, and bootstrap — ratified an LLM usage policy authored by longtime contributor Jynn Nelson, after more than 3,000 Zulip messages, 600-plus comments on the pull request, and a joint final comment period across all five teams.
The core rule fits in one sentence: LLMs may answer questions, analyze, distill, refine, check, suggest, and review — but not create. That's a capability split, not a tool split, and it's a smarter place to draw the line than anything the ban-or-disclose camps have produced.
What the line actually means #
Everything private is fine, no disclosure needed: asking a model to explain a snippet of MIR lowering, summarizing a 200-comment issue for yourself, having it critique your patch before you push. The policy's framing is that LLMs should help you write better, not faster.
Public artifacts are where it gets strict. Comments, issue bodies, and PR descriptions originally written by an LLM are banned from personal accounts outright. So are LLM-authored doc comments, safety comments, and compiler diagnostics — the places where wrong-but-plausible prose does the most damage, because a fabricated safety comment can launder an unsound unsafe
block through review. LLM code reviews are advisory only; they can never be the basis for merging or rejecting a change. Review bots must run on separate, clearly labeled accounts that contributors can block.
LLM-generated code isn't banned — it's quarantined into an explicit experiment. Such PRs must be pre-arranged with a reviewer, restricted to non-critical areas (the trait system, MIR building, and the query system are off the table), tested to a higher bar than human-written code, carry an ai-assisted
label, and get logged to a Zulip channel so the project can study what actually happens. And there's a circuit breaker: if more than half the PRs merged in any six-week window are LLM-created, new ones are frozen for at least ten days while the teams reassess.
One definition deserves special attention if you contribute: text "originally created by an LLM" includes editor autocompletion. If Copilot tab-completes the body of your function, that's LLM-created code under this policy, with everything that implies. The reasoning is that origin sets structure and style permanently, no matter how much you edit afterward. Practically: turn off AI completions in your rust-lang/rust checkout, or be prepared to disclose and pre-arrange.
The real problem is reviewer economics #
The policy's rationale is refreshingly unphilosophical. It brackets the copyright and environmental debates as explicitly off-topic and focuses on two operational facts. First, rust-lang/rust has roughly 1,300 open PRs right now, and reviewer attention — not code production — is the binding constraint. LLMs move cost from author to reviewer: generating a plausible patch takes minutes, verifying one still takes an expert hour. Second, polish used to be a signal. A well-structured PR with clean commit messages once told a reviewer the author understood the change; now it tells them nothing. That's the same asymmetry that pushed curl to crack down on AI-generated bug bounty reports — slop is cheap to make and expensive to triage — but Rust is the first project of this size to write the economics directly into policy rather than reacting incident by incident.
This is also why "disclosure-only" policies underdeliver. Disclosure tells a reviewer that a model was involved; it doesn't restore the effort signal or cap the review load. Rust's answer — ban LLM output in trust-bearing prose, meter it in code — targets the actual failure mode.
A policy built like software #
The most exportable part isn't any single rule; it's that the policy is instrumented and reversible. The ai-assisted
label plus the monitoring channel generate data. The circuit breaker is a rate limiter with a defined trip condition. Amendments are deliberately cheaper than adoption was, and the whole thing can be dissolved by FCP or superseded if the leadership council stands up a dedicated LLM sub-team. Two competing RFCs for a project-wide policy (rust-lang/rfcs#3950 among them) are still in flight; this per-repo policy is scoped so it doesn't have to win that larger war first. Most projects declare AI policy as a values statement. Rust shipped it as a system with feedback loops — which means it can be wrong and get fixed, instead of being wrong and becoming lore.
The moderation stance is quietly the best design decision: it's explicitly not your job to play detective. Style is insufficient evidence, public accusations are out, and suspected violations go to moderators. Anyone who watched other communities descend into "this comment sounds like ChatGPT" witch hunts knows how much damage accusation culture does; Rust pre-committed against it. The trade-off is real, though — combined with no active detection, the policy mostly binds the honest. Dishonesty about LLM use carries warning-then-ban consequences, but only when it surfaces.
The case against, and why it loses #
The dissent inside the project is worth taking seriously. Niko Matsakis argued this is "worse than no policy at all" and that contributors "are going to read it and just be overwhelmed." The complexity critique lands: this is a multi-page rulebook with three disclosure tiers, an experiment protocol, and a circuit breaker, and new contributors now face a longer on-ramp for what might be a typo fix. (Trivial changes get a carve-out with disclosure, but you have to know that.)
But "no policy" wasn't neutral — it was per-reviewer improvisation plus recurring Zulip flame wars, in a repo where a hallucinated invariant can become a soundness hole in the language the internet's infrastructure is increasingly written in. And unlike QEMU-style bans, this policy generates the evidence needed to revise itself. If the experiment shows well-disclosed LLM code holds up, the data will exist to loosen the rules; if it shows the opposite, the breaker trips.
If you maintain a large project, this document is now your reference implementation: scope per-repo, split analysis from authorship, meter code through a labeled experiment, and forbid detective work. The ban-versus-disclose era of open source AI policy ended today. What replaces it is policy that ships with telemetry.
Sources & further reading #
[Rust-lang/rust is adopting an LLM policy](https://blog.rust-lang.org/inside-rust/2026/08/05/rust-langrust-is-adopting-an-llm-policy/)— blog.rust-lang.org -
[LLM usage policy for rust-lang/rust](https://forge.rust-lang.org/policies/llm-usage.html)— forge.rust-lang.org -
[Add an LLM policy for rust-lang/rust](https://github.com/rust-lang/rust-forge/pull/1040)— github.com -
[Rust Moves to Restrict LLM Use in Contributions After Months of Debate](https://socket.dev/blog/rust-moves-to-restrict-llm-use-in-contributions)— socket.dev -
[Add contribution policy for AI-generated work](https://github.com/rust-lang/rfcs/pull/3950)— github.com
[Rachel Goldstein](https://sourcefeed.dev/u/rachel_goldstein)· Dev Tools Editor
Rachel has been embedded in the developer tooling ecosystem for nearly eight years, covering everything from IDE wars and package-manager drama to the quiet rise of AI-assisted coding. She has a soft spot for open-source maintainers and an unhealthy number of terminal emulators installed on a single laptop.
Discussion 0 #
No comments yet
Be the first to weigh in.