The Mesa project, the open-source heart of Linux graphics drivers, has chosen a pragmatic way to coexist with LLM-based code assistants. In the AGENTS.md file that defines the rules for AI agents, the project now allows these tools to generate code comments and commit or patch messages, provided a human reviews and edits them before merge.

AGENTS.md is not just a reminder: it is a versioned document inside the repository, designed to be read by automation tools. Unlike a top-down corporate policy, it lives next to the code, changes with the project, and can also be applied by self-hosted tools that do not rely on cloud services. This detail matters more than it might seem.

A risk hierarchy, not a ban

Mesa's move is not a blanket opening. It formalizes a hierarchy of risk. Comments and commit messages do not change software behavior, but they influence maintainability, review, and project history. Letting an LLM draft them reduces the burden on maintainers, especially in the less rewarding parts of the work; requiring human review is meant to prevent automatically generated text from becoming noise or, worse, misleading descriptions.

From an incentive standpoint, the change shifts the boundary of responsibility. If an AI agent produces an inaccurate commit message and the maintainer accepts it without editing, the responsibility remains human. This does not eliminate review work: it concentrates it into a final check, cheaper than writing from scratch but still necessary. Occasional contributors may benefit, because the first draft arrives already shaped; reviewers may find themselves handling a larger flow of uniform texts, with the risk of no longer distinguishing the author's intention from the machine's suggestion.

For teams running code assistants in on-premise or air-gapped environments, Mesa offers a concrete example of declarative policy. No external service is required: the rule lives in the repository and any local agent can read it before acting. It is a lightweight governance mechanism that fits data sovereignty because the code does not need to leave the infrastructure to be processed. The quality and provenance problem remains, but at least the scope of use is under the project's control.

The next tension will likely be about extending the permission: when generated commit messages become the norm, a project's history could flatten into a single style and lose traces of human reasoning. Mesa has chosen not to ban, but to ask for one final look. It is a compromise that recognizes the value of LLMs without handing them the keys.