AI / LLM Policy

Our policy is based on the NL Net Labs Policy with some small changes.

We restrict how Large Language Models (LLMs) can be used in the context of our organisation and our projects. If a submission (e.g. PR, issue, comment, forum post, etc.) does not comply with this policy, we may close or delete it without prior notice.

Policy

No output of LLMs in code or documentation

We require all code and documentation contributions to be authored by a human. You must not include content generated by LLMs or other probabilistic tools.

Disclose LLM use

We want to interact with humans, not with LLMs. In your interactions with us, be respectful of our time and avoid LLM usage. This includes opening issues, sending vulnerability reports, and posting in our community spaces.

If you still use an LLM during interactions with us you must disclose this.

Translation can be helpful if English is not your native language. If you use machine translation when communicating with us, we encourage you to disclose such use to us so that both sides are aware of possible miscommunication as a result of mistranslation.

Use of LLM translation is discouraged based on their generative attributes that would most likely confuse rather than ease the discussion.

LLM output remains your responsibility

Your use of LLMs for linting, analysis or review is permitted under this policy. However, you remain responsible for the output of an LLM. If an LLM assists you in finding or analysing an issue, you remain responsible to understand and verify the correctness of the information you share with us.

Examples

LLM-assisted vulnerability reporting

We accept reports of vulnerabilities found with LLMs. To comply with this policy, after the LLM finds an issue, you as the human contributor verify the issue and the estimated severity. Then, when you send a report to the Kanidm project you must disclose the use of an LLM.

See the security page for more information on reporting vulnerabilities to us.

PR creation

We do not accept LLM-generated contributions. Any code you submit cannot be generated by an LLM. When you open a PR, use your own words and be concise in the PR description.

In general, you should not open PRs for new features without talking to us first. If you have ideas on how our software could change to accommodate your use-case, please share your own thoughts by opening an issue or discussion first.