Forem: Bernát Kalló

Creating an AI policy, part II

Bernát Kalló — Mon, 16 Mar 2026 17:38:06 +0000

A lot have changed since I wrote about my thoughts on creating an AI policy. Now I write lots of code with coding agents, and developing much more AI integrations into apps. AI coding agents are very standardized now, AI slop is prevalent, and hobbyists operate rogue AI agents with hardly any oversight.

How should we define an AI policy in the early 2026 era?

How about something we could summarize as:
Nothing changes with AI.

What I mean by this is: Software is still software, and prompts + LLMs are also software (albeit nondeterministic).

If we wanted 98% happy users before, we should want the same, even if we have AI features.

If we had to ship software that works correctly 99.9% of the time, we should have the same endeavor now. Even if a quarter of our code is prompts. And even if half of our code is written by a coding agent.

Having a nondeterministic automated system write parts of the code is an additional hazard compared to the old days. So we need to take more care with the steps that ensure the quality and correctness of the code: planning, architectural design, refactoring, testing, code review, static analysis etc., to get back to that 99.9% (or whatever figure we have, depending on our field).

If we've been believing in unit tests, we should have LLM evals or something alike for the stochastic part of our codebase.

Nothing changed: software still must be made for humans. And made by humans, even if with AI tools. And humans must still take the responsibility for their software. And the behavior of their software.

This piece of wisdom from an ancient law book might be relevant in this topic:
"When you build a new house, be sure to install a railing around your roof, so that you won't be held guilty if someone dies falling from it." (Deuteronomy, FBV translation)

Different color schemes for different projects in VSCode

Bernát Kalló — Thu, 13 Feb 2025 14:43:21 +0000

Helps in context switching, at least for me.

Two ways to set this:

create a Profile for each project, and set workbench.colorTheme in the profile settings
OR create a Workspace for each project, and set workbench.colorTheme in the workspace settings

If other web frameworks were named like Ruby on Rails...

Bernát Kalló — Mon, 27 Jan 2025 05:51:23 +0000

Laravel – PHP with Pails.
NestJS – TypeScript with Tails.
J2EE – Java in Jails.
Netcat – Bash on Bails.

Creating an AI policy

Bernát Kalló — Tue, 07 Nov 2023 20:11:31 +0000

The gold rush has irreversibly begun, software companies are shoveling AI support into their apps, while experts in the field cannot scream loud enough about the risks. While there are infinite new opportunities, difficult to comprehend how immensely valuable, certainly there are also many dangers, which are maybe even more difficult to realize.

We as software developers and product managers have a HUGE say in what will happen and what not in cyberspace. We have way more power than we often realize. And because of that, we need to be very careful. And responsible. And we need to have principles.

Principles, by definition, should not depend on the actual opportunity. We should be prepared not to blindly follow the flow when a tempting opportunity comes if it compromises our principles. So I believe it's good to have an AI policy ready, preferably published on our website, so when I'm asked to create this or that AI integration, there is something written that I can refer to. A Ulysses pact.

So I've started to sketch an AI policy for my software development team, based on the bits that I've already understood about the risks of generative AI.

Here it is:

Our basic principle is that humans should rule over the computer and not the other way around. Therefore we do not create and do not install a system where

an AI makes decisions about humans, without a human taking responsibility about the decision
where an AI can uncontrolledly influence the outside world, or make uncontrolled actions on the internet

We think helping human editing work by AI is useful, however, we see the risks when the human editor only superficially verifyies the AI-generated content. Therefore, in the applications we develop, every longer (>~10 words) AI-generated content included into human-edited content will be marked with some subtle mark (color, comment). The human editor can remove this mark, thus explicitly taking responsibility for the content.

Similarly, when I code with an AI assistant, I strive not to accept longer (multi-line) AI-generated code completions at once, only line by line or word by word.

This is only my first attempt in this new genre, and I plan to further refine it as new trends are happening and my understanding of the topic broadens.

I encourage you to think about this difficult and sensitive topic. And please share your thoughts!