Rust's new LLM policy ships with a circuit breaker

Most AI contribution policies are a paragraph of vibes. The Rust LLM policy that landed this week is the first one we've read that has a metric, a trigger, and an off switch. Five teams in the Rust project ratified it, and if you're writing an AI policy for your own codebase, this is the one to steal from — not because Rust is Rust, but because someone finally wrote down what happens when the policy stops working.

What actually happened

Per the Inside Rust blog, the policy applies to rust-lang/rust only, and only to the teams that ratified it: compiler, libs, types, rustdoc, bootstrap, and their subteams. Other repos, submodules, and teams that didn't sign on — lang and edition among them — set their own rules. It is explicitly not a project-wide stance on AI.

The policy text turns on one line: it's fine to use LLMs to answer, analyze, distill, refine, check, suggest, and review — but not to create.

That splits cleanly into three buckets:

• Fine, no disclosure: private use. Ask it questions, have it summarize an issue thread, have it review your own diff. Learn from output, then write the thing yourself.
• Fine with disclosure: machine translation, trivial changes like typos and links, bugs you found via an LLM and then personally verified, and review bots — which must run on a separate account, be maintainer-approved, non-blocking, and blockable by any contributor.
• Banned: LLM-generated PR descriptions, issue bodies, comments, and documentation. Also non-trivial safety comments and compiler diagnostics, and treating an LLM review as sufficient to merge.

There's a narrow experimental lane for LLM-written code: pre-arranged with a specific reviewer, non-critical, extremely unlikely to cause soundness regressions, comprehensively tested, held to the same bar as human code, and understood in full by both author and reviewer. Tag it ai-assisted.

Then the part nobody else writes down. If more than 50% of merged PRs in a six-week window are LLM-created, new LLM PRs get suspended for at least ten days. A circuit breaker with a threshold and a duration.

Lying about LLM use is a Code of Conduct matter — warning, possible ban. So is harassing contributors over suspected AI use. Both directions are covered.

Why an LLM policy matters for your business

You don't maintain a compiler. You do have a repo, contractors pushing to it, and no written answer to "was this generated?"

Separate private use from public artifacts. This is the load-bearing idea. Nobody can audit whether you asked a model to explain a stack trace, and nobody should try. What's auditable is what lands in the repo with your name on it. Write your policy against artifacts, not intentions — it's the only version that's enforceable.

Disclosure beats prohibition. Rust didn't ban the tools. It made hiding them a conduct violation. That's the same trade we recommend to every client: you cannot detect AI-written code reliably, so stop pretending you can gate on detection and gate on honesty instead.

Ship the circuit breaker. Pick a number now, while you're calm. "If AI-generated changes exceed X% of merges, we pause and review" is a decision you make once. Without it, the conversation happens during an incident, and it's about blame instead of throughput.

Rust is the second major open-source project to formalize this in weeks — Debian's general resolution is still working through its ballot. The overlap between them is your default policy.

Sources: Inside Rust Blog, rust-forge LLM usage policy.