Your AI Coding Policy Is Either a Ban or a Vibe. Write One People Can Follow.

Eight sections, one CI check, and a tool matrix that covers everything from public repos to CUI, so your developers stop guessing.

On October 7, QGIS merged an enhancement proposal that bans LLM-, AI- and agent-assisted code from its main repository (coverage). The reasoning is sympathetic: maintainers can’t review the flood. The Hacker News reaction was less about the ban than about the wording. The policy doesn’t say what “assisted” means, or whether the objection is about quality, law or ethics. One commenter summed it up: don’t make contributors guess.

Inside companies, the problem runs the other way. A recent Ask HN on centralising AI for development shows teams improvising: one built a sandbox-and-Slack harness, another standardised on a single agent “for simpler billing.” Industry write-ups put the share of developers using tools IT never approved at around half (example). Defense contractors are being sold LLM gateways for ITAR and CUI data, and the comment thread goes straight to the hole every policy misses: coding agents fetching URLs and calling MCP servers that bypass the gateway.

A survey of 120 open-source AI policies found 72 allow AI with conditions, 37 ban it…