AI Use Policy

AI Use Policy

Last updated: June 2026

We use AI tools. Here's how, and why we're direct about it.

Freelock regularly uses AI tools — including large language models like Claude — to amplify the expertise we bring to your project. We want to be direct about this because we think you deserve to know.

How we actually use AI

Writing and content

AI assists with content on this website and in client communications — but it is never the first draft, and never the last word. We start with human thinking: a point of view, a story, an argument. AI helps us develop and refine that — not invent it.

We are acutely aware of "AI slop" — the flood of generic, hollow, keyword-stuffed content that AI makes it trivially easy to produce. We hate it as much as anyone. Our standard is simple: if a piece of writing doesn't have something genuinely worth saying, we don't publish it. AI doesn't change that standard; it's just another tool we hold to it.

One of the newer topics we write about on this site is AI itself — specifically, how we use it effectively in web operations work. If that's relevant to you, browse our posts.

Marketing and sales

We use AI to help identify organizations we might be able to help — researching prospects, drafting outreach, and refining how we describe our work. If you received an email from us, AI may have played a role in finding you or shaping the message. A human wrote and reviewed it before it was sent, and a human will be on the other end of any conversation that follows.

We don't use AI to simulate relationships or manufacture warmth we don't mean. The goal of our outreach is to start a real conversation with organizations that have a genuine need for what we do — not to flood inboxes at scale and hope something sticks.

Coding and development

We use AI tools actively in development — for writing code, exploring approaches, catching bugs, and speeding up work that would otherwise be slow and repetitive. The same principle applies: an experienced developer reviews everything, understands it, and owns it. We don't ship code we can't explain.

Testing, tooling, and quality assurance

Some of our most effective AI use is unglamorous: generating test cases, building internal tools, writing scripts that check for regressions or flag anomalies. AI is well-suited to this kind of systematic, methodical work — and it frees us to focus on the judgment calls that actually require human expertise.

Planning, analysis, and feedback

We use AI as a thinking partner — for critical analysis, project planning, reviewing our own proposals, and stress-testing our assumptions. It's useful for exactly the same reason a good colleague is useful: it pushes back, asks clarifying questions, and notices things you missed.

Website functionality

We use AI in bounded, automated roles in some website features — comment moderation being a current example. When a comment is submitted, AI reviews it as a first pass: flagging spam, holding borderline content for human review, and approving clear cases. No comment is permanently removed by AI alone. It triages; a human decides.

We also use AI for auto-tagging content and finding relevant images — for instance, searching Pixabay for illustrations that fit a post. These are low-stakes, reversible tasks where AI saves time without creating meaningful risk.

This is the same principle we apply to infrastructure: AI gets a limited, well-defined role with a constrained blast radius. It can slow things down for human review. It cannot take irreversible actions on its own.

When we build client sites with AI-assisted features, we apply the same thinking. Automated roles should be narrow, reversible where possible, and supervised.

Drupal AI integration

We work extensively with Drupal's growing AI module ecosystem — and we're genuinely enthusiastic about where it's heading. We use AI-assisted tools for building out page layouts, and agent support within Drupal is already capable enough to be useful for real workflows.

What makes this particularly compelling from a security standpoint is Drupal's access model. AI agents in Drupal can run as regular authenticated users, which means they're automatically subject to all the same role-based access controls that govern human users. You don't need a separate permission system for your AI agents — the one you already have works. That's a meaningful architectural advantage over approaches that require bespoke guardrails bolted on afterward.

Drupal AI also ships with extensive logging, giving administrators full visibility into what AI features are doing and when. For organizations that need auditability — government agencies, nonprofits with compliance obligations — this matters.

Security operations and attack mitigation

We use AI extensively in security work for our clients — analyzing server logs, identifying attack patterns, and generating firewall rules and Fail2ban configurations in response. When a site comes under attack or shows anomalous traffic, AI helps us move from raw log data to actionable rules far faster than manual analysis allows.

The rules AI produces are reviewed and deployed by a human. AI identifies the pattern; we decide what to do about it. This combination — machine speed on log analysis, human judgment on response — is more effective than either alone.

What we do not use AI for

We do not use AI to run websites or manage production environments.

This is a firm line, and it's not accidental. AI systems are, fundamentally, untrusted users — they can be manipulated, they make confident mistakes, and the consequences of a wrong action in a production environment can be severe. Our infrastructure practice treats AI accordingly: strong guardrails, limited access, minimal blast radius. Even a successful prompt injection attack against one of our systems should be able to do very little.

We use AI to build tools that help us manage environments. We do not let AI use those tools autonomously against production systems.

Community standards and disclosure

Different communities we participate in have different expectations around AI disclosure. Drupal.org, for example, currently requires contributors to disclose AI use. We observe those community standards wherever we participate — and we encourage you to check the norms of any community you contribute to.

On this site and in our client work, the default assumption should be that AI is involved at some level in many places. This page is our standing disclosure. We won't flag every post or deliverable individually, but we won't obscure it either.

Our deep ambivalence

We hold this with deep ambivalence.

AI tools are genuinely useful — they help us deliver better work, catch things we might miss, and stay current in a field that moves fast. At the same time, we are not comfortable with every direction the AI industry is taking. The concentration of power in a handful of companies, the environmental costs of large model inference, the displacement of workers, the use of creative and professional work to train systems without meaningful consent — these are real concerns, not theoretical ones.

Ambivalence here doesn't mean indifference. It means we care deeply on both sides of the argument — about the genuine value these tools provide and about the serious costs they carry. We don't resolve that tension by picking a side and ignoring the other. We try to use these tools in ways that keep humans in control, that don't erode your ability to get work done without us, and that support rather than undermine the open-source ecosystem we've been part of for more than two decades.

If AI use is a dealbreaker for you — for any reason — we respect that. We'd rather you know upfront than discover it later.