Hi all, ... let me play (again) devil's advocate here: I agree with the assessment that more people than not are already using these tools... nor am I against the responsible use of them... but does this have any effect on copyright rules? I'm not a lawyer, but I think us "voting" with our keyboards and fingers (if those are already too archaic and we are already using voice commands then add "voice" to that list) doesn't matter when you have to enforce them. Just because things come without any attribution out of these AI harnesses and tools doesn't mean you can do with it whatever you want, in the end the results are not magically created out of nothing.
When we (as humans) do the thinking then I see no problem, even if we use AI tools for *discovery* (research, inspiration etc.); no matter how sophisticated those tools, in the end they are on the same level like Google Search on steroids... but - I think - only when you use them for discovery (my opinion, no scientific proof). But even when we do all the thinking by ourselves then there are still some caveats: e.g. let's try to implement something that is published as an ISO standard or use the documentation of one of the card processors or use the developer portal of SWIFT... there is a ton of documentation available for "free", but that doesn't mean we can go and use it to implement our next thing and slap an Apache license on it (or any license for that matter) without the consent of the authors/companies. Just because I processed the content through my brain by reading it doesn't make the copyright (or NDAs) go away... at all. Maybe some of you remember the dispute between Google and Oracle when Google decided to use Java as their primary programming language for Android (in fact they used Apache Harmony https://harmony.apache.org ... which brings us back to Apache). Disclosure: was a big fan that Apache had created an alternative to Oracle's (Sun's) Java SE, the JDK was pretty much calcifying with releases every couple of years (half a decade?). Now we know these things were sorted out eventually, but they cost money we don't have, simple as that. And in the end, what's the primary programming language on Android now? The reason why I mention this: this case was much more discrete and reproducible then the use of any AI tools that don't produce the same outcome each time you run time without modifications. If someone could give me an idea how the "simpler" (read: predictable) case with clean-room reverse engineered code ended in disaster (well, now we have thankfully OpenJDK... but still not Apache licensed!) and we should expect anything different if we turn a wheel of fortune (I'm exaggerating)? Another example: we know that we sometimes have wonky builds and they break for no apparent reason, can happen, not concerned about it, because I know that we can track the issues down if we want, or we just update Gradle/plugins. But how do we want to ensure the reproducibility of AI generated code? Is this then considered ephemeral code (like code generated from OpenAPI specifications... lands in the "build" folder)? If this is not a problem, can you explain why? This is especially important when it's not revealed how the specific setup looked like to produce the results (which provider? which harness? prompts? agents? skills? any other configuration...). Or let me ask the question differently: how does it matter that we go after everyone who just uses the words "Apache", "Fineract" or a combination of those without attribution and acknowledging the copyright and then suddenly source code generated with input that can't be traced back to its original author(s)? Side note: Anthropic started to watermark their stuff, didn't look into the details, no idea what the implications are, but it looks to me that they want to insulate themselves... For me this translates to "we give you what you asked for, but we also want to make sure you read the tiny font disclaimer and can't claim ignorance"... all my assumptions, I might be wrong. I have more points (what about bias; access for everyone in the community... see recent export control decision on Anthropic... providers go down, we all stop?; excessive budgets as an entry barrier; how do these tools and their prices conform with our moto "Community over Code"... code doesn't matter... at all? ... community of people/machines?...), but will stop here. In short... I'm ok with: - using AI for discovery, like Google Search on steroids - feed it with stacktraces, get answers out - get any kind of inspiration I'm not ok: - not revealing the setup that generated the results - ... nor mark the parts of the results that were generated without any human involvement - use these tools without pinning down (agreeing on) certain architectural rules; without this we just add more technical debt - watch 12 AI agents assume anthropomorphized roles ("as a project manager", "as a senior developer"....) playing ping pong for 2 days to re-implement Base64 encoding; who is in control here? are the solutions something we really need or didn't know of libraries that do the same thing and are maintained by dedicated people that might know more about that problem domain than ourselves (or the AI tools)? - use an AI tool to review AI generated code; this is not "90% certainty code generated plus 90% review certainty equals 180% certainty overall"; the real equation is "90% TIMES 90% is 81%"; in other words: combining these tools in the wrong way might get us in a worse place - dropping changes/PRs with more than 100 files changed is even more tempting now - going through endless review - generated code - review - generate code - review - ... loops I'm on the fence with: - generating documentation; the results here can be really great, incredible results with visualizations, especially for people that drag their feet in that area (like myself); if we feed only our sources then I see no problem at all actually - security scans... I say: whatever helps; BUT: I still have to see any usefulness here that exceeds any of the traditional command line tools out there (that you run in 3sec with immediate results)... I really don't want to write an essay on intrusion detection (read with irony) just to get the same two SQL injection issues... just 3 weeks later (exaggerating to bring a point home) As usual, these are only my 2 cents. I think some of it can be generalized, some does only apply to me, but wanted to share what I currently think of this. As always, please correct me where you think I didn't get it right.# Cheers, Aleks On Tue, Sep 1, 2026 at 1:40 PM Ádám Sághy <[email protected]> wrote: > Hi everyone, > > > My two cents: > > > Since AI is already being used, having rules and a playbook would be > beneficial to avoid any misunderstandings. > > > Considering its widespread adoption across various fields such as > development, debugging, testing, brainstorming, and PR reviewing, we don’t > need to debate whether the Apache or Fineract community wants it. It’s > already in use, and contributors will continue to use it (*I don’t > believe there’s a way to prevent it, nor should it be!*). Let’s focus on > determining appropriate boundaries and its intended use. > > > Disclaimer: I am not up to date with latest “recommendations” of Apache on > this topic. > > > Regards, > > Adam Saghy > > > > On Sep 1, 2026, at 8:53 AM, Sujan <[email protected]> wrote: > > Hi Aman, > > +1 to having some clear boundaries around AI-assisted development. > > I think there are valid positives and negatives here. AI can definitely > help with productivity, debugging, and refactoring, but contributors should > still understand and take ownership of the changes they submit. If PRs > become mostly AI-generated, it also makes them much harder to review > effectively. > > I think a lightweight, project-specific policy would be a good middle > ground rather than completely discouraging AI or allowing unrestricted use. > > On Tue, 1 Sept, 2026, 11:42 VICTOR MANUEL ROMERO RODRIGUEZ, < > [email protected]> wrote: > >> Aman, >> >> Thank you for starting this important topic. >> >> *+1 to starting a dedicated discussion and adopting a lightweight, >> project-specific AI policy.* >> >> I support the direction because AI-assisted development is already >> happening (it is very noticeable this year before the GSOC and the >> increasing numbers of PRs submitted and merged) and clear, practical >> guidelines (for developers and reviewers) will help us benefit from it >> without creating problems for maintainers or the project’s legal posture. >> An optional disclosure approach plus a short *AI_POLICY.md* inspired by >> Apache Fory’s is a sensible starting point. It can be adapted for Apache >> Fineract rather than copying it wholesale. >> >> To address the concerns raised earlier (including those from Aleks) I >> think is good to stay aligned with the ASF Generative Tooling Guidance >> https://www.apache.org/legal/generative-tooling.html >> >> Best regards >> >> Victor Romero >> >> >> >> El lun, 31 ago 2026 a las 23:44, Aman Mittal (< >> [email protected]>) escribió: >> >>> Hi everyone, >>> >>> I want to revive the discussion based on >>> https://lists.apache.org/thread/xxoqt3jn8trhwo1lnxjy46r1dkolfg1h >>> >>> and Concerns raised by Aleks in >>> https://lists.apache.org/thread/oq25gyjsx0wry4jf58odds9z92pfx6bj >>> >>> Regarding the usage and guidelines of AI, I think we need to discuss >>> AI-assisted development a bit more, so I'm creating this dedicated thread >>> on the dev list. >>> >>> As per my understanding, using AI is fine if contributors understand >>> their work and can explain their reasoning for each line. >>> >>> So, I'm thinking we can start with an optional disclosure policy on >>> that. >>> I think we can add a AI_POLICY.md for each repo. One policy we can take >>> inspiration from is >>> https://github.com/apache/fory/blob/main/AI_POLICY.md >>> While we do not need to copy it entirely, we can take inspiration from >>> it and modify it for FINERACT and all the repos based on community feedback. >>> >>> I suggest that it should include Commonly used AI setups that >>> contributors did not declare in an AI usage disclosure. >>> >>> What does the community think about this? >>> >>> Regards >>> Aman >>> >>> >
