Earlier this year KPMG and the University of Melbourne published the largest study of public trust in AI I have seen: more than 48,000 people across 47 countries, surveyed between November 2024 and January 2025. The numbers are blunt.
66% of people already use AI regularly. Only 46% are willing to trust it. 58% view it as untrustworthy. Compared with the same team’s 17-country study in 2022, before ChatGPT, people have become less trusting as adoption went up.
At work it gets worse. 58% of employees use AI and 31% use it weekly or daily. Almost half admit to using AI in ways that contravene company policy, including up sensitive company information into free public tools. 66% rely on AI output without evaluating its accuracy. 56% say they have made mistakes in their work because of AI. 57% hide their use of AI and present AI-generated work as their own.
And the organisations? Only 47% of employees say they have received any AI training. Only 40% say their workplace has a policy or guidelines on generative AI use. Half of respondents are worried about being left behind if they do not use it.
Meanwhile 70% of people say regulation is required and only 43% think existing laws are adequate.
Source: KPMG / University of Melbourne, Trust, attitudes and use of AI: A global study 2025.
The thesis #
Read those numbers together and the story is not “people are scared of AI.” The story is: people use AI constantly, inside organisations that have not told them what is allowed, with no record of what the AI did, and no way to check it. Then they hide it.
That is a governance problem, not a feelings problem. You earn trust from AI the way you earn it from a new engineer: small scope, watch the work, keep a record, widen the scope when the record is good.
The study’s own recommendations are governance, training and transparency. Those are the three things we have been building at Hive Commons, because we hit the same gap ourselves when we let agents loose on real repositories.
Hive: agents with limits, a record, and a human on every action #
Hive is a co-maintainer for any GitHub, Jira, or Linear project. It watches issues, PRs, failing CI, CVEs and dependabot alerts, and dispatches short-lived AI agents (Claude, Copilot, Codex, Goose and others) to deal with them. The agents do the chores. Humans keep every decision that matters. Apache-2.0, run it yourself or use the hosted hub.
The trust mechanisms are not bolted on. They are the product.
Six trust levels, enforced in code. Hive uses the AI Codebase Maturity Model (ACMM): six levels from L1 (advise only, nothing touches GitHub) through L3 (agents may open PRs, every one carries a hold label a human must remove) to L6 (merge on green CI). The level decides which agents run, in which mode, with which GitHub permissions. You start low. You never have to move up. A project that wants design discussion before any PR does not need a workaround; it needs Measured mode, where agents may only file findings as issues. See the ACMM policy matrix and the ACMM paper.
Deterministic filters and gates. The Governor reads your real backlog and filters it by labels, areas and complexity. Agents only see work you have allowed. Gates decide what may land. Prompts are templates filled from facts (the issue, the CI log, the diff, the trust level), not hand-tuned prose. The check is not optional and not left to whoever is in a hurry, which is the answer to “66% rely on output without checking.”
An audit log owned by a named human. Every action a hive takes is appended to /data/audit.jsonl: timestamp, who, what, which agent, which repo, which PR. Hold lifts, merges, config changes, hook failures. See audit-log.md.
Attribution on every PR. Agent-opened PRs carry a — hive: trailer naming the agent, backend, model and requester (governor.attribution_trailer, default on). The matching audit entry is written regardless of the toggle. Nobody has to hide AI-generated work because the work says what it is. See hive-open-pr.md.
Evidence, not certification. Every reviewed PR gets a review evidence bundle: what was reviewed, under which policy, what reviewers found, what CI said, who acted, how it merged. Bundles are hashed and optionally Ed25519-signed. This week we shipped plain-English evidence grades (#13213), reverts and issue re-opens recorded as change failures (#13244), and self-reported versus evidence-derived reviewer confidence (#13251). Your control owners decide whether that meets your change-management policy. We do not decide for you. See review-evidence.md.
What does that produce? As I write this there are 57 hives running. In the Hive repository itself, 1,993 PRs have merged since 30 September 2026, 815 of them opened by the hive app, each with a human hold lift or a green CI record behind it.
Spektacular: intent you can review before code exists #
Spektacular (Spek) is a single Go binary for spec-driven development with coding agents. You write a markdown spek: requirements, constraints, acceptance criteria. plan new explores the codebase, asks clarifying questions and writes an implementation plan. implement new drives the agent through the plan and validates the result against the acceptance criteria.
The gap it closes is the one between what you asked for and what the agent built. Each stage is a stepwise state machine: stop, inspect, edit, resume. spektacular status shows where every piece of work stands. With plan.strict_spec_changes on, editing the spek after a final plan marks the plan stale and implementation refuses to continue until it is replanned and re-approved. Intent stays reviewable at every step. It works with Claude, Bob, Codex, Copilot CLI and omp, so it meets people where they already work.
Nous: the scientific method, with two human gates #
Nous is a hypothesis-driven experimentation framework. An agent forms a falsifiable hypothesis about a software system, designs a controlled experiment, runs it, and extracts reusable principles whether the hypothesis was confirmed or refuted. A deterministic Python orchestrator, not an LLM, drives the loop. Every iteration has two human gates: one to approve the experiment design, one to approve the findings.
Inside Hive it is the Experiment Lab (ACMM L4 and above). It records a baseline of hive behaviour, designs experiments against repo code such as tests, CI config and automation scripts, and measures each against that baseline before anything is applied for real. Fast-fail bounds cut experiments that go wrong. Principles compound, so the system does not repeat mistakes. See the Experiment Lab guide.
The 56% who made mistakes because of AI mostly did so because nobody measured. Nous is measurement with a human sign-off at both ends.
What it looks like in practice #
A maintainer running a hive on a CNCF repository reviewed the last 100 agent-generated issues and PRs. The findings fell into a handful of recurring classes: unasserted test arms, coverage policy, duplication, lint, CSP baseline, stale citations. For each class the maintainer wrote down the CI gate that was missing, then opened and landed the PRs that added those gates.
That is the loop working. Agents surfaced the problems. A human read the record, found the pattern, and turned it into deterministic policy. The agents now have less to do in those areas, which is the point.
Come and look #
Everything above is Apache-2.0 and public. Run a hive on your own cluster, Podman or Docker Compose, or onboard a spoke on the hosted hub at hive.hivecommons.dev. Start at Measured. Read the audit log. Decide for yourself when to move up.
If you are at KubeCon NA, find us. We would rather show you the audit log than tell you about it.
Andy Anderson, Hub Admin, Hive Commons. [hivecommons.dev](https://hivecommons.dev/)
Sources #
- KPMG / University of Melbourne press release (22 May 2025): https://kpmg.com/cn/en/media/press-releases/2025/05/global-study-reveals-trust-of-ai-remains-a-critical-challenge-reflecting-tension-between-benefits-and-risks.html
- Gillespie, N., Lockey, S., Ward, T., Macdade, A., & Hassed, G. (2025). Trust, Attitudes and Use of Artificial Intelligence: A Global Study 2025. University of Melbourne and KPMG. DOI 10.26188/28822919. https://kpmg.com/xx/en/our-insights/ai-and-technology/trust-attitudes-and-use-of-ai.html
- Hive repository (v5): https://github.com/hivecommons/hive
- ACMM policy matrix: https://github.com/hivecommons/hive/blob/v5/src/docs/acmm-policy-matrix.md
- ACMM paper: https://arxiv.org/abs/2604.09388
- Audit log format: https://github.com/hivecommons/hive/blob/v5/src/docs/audit-log.md
- Attribution trailer (
governor.attribution_trailer): https://github.com/hivecommons/hive/blob/v5/src/docs/hive-open-pr.md - Review evidence bundle: https://github.com/hivecommons/hive/blob/v5/src/docs/review-evidence.md
- Evidence PRs: https://github.com/hivecommons/hive/pull/13213, https://github.com/hivecommons/hive/pull/13244, https://github.com/hivecommons/hive/pull/13251
- Spektacular: https://github.com/hivecommons/spektacular and https://spektacular.dev
- Nous (upstream): https://github.com/AI-native-Systems-Research/agentic-strategy-evolution
- Experiment Lab (Nous in Hive): https://github.com/hivecommons/hive/blob/v5/src/docs/strategy-lab.md