Skip to content

RackN AI-Assisted Development Disclosure

This page is RackN's standing statement about the use of AI assistance in the development of Digital Rebar Platform (DRP) and its associated content packs, plugins, and tooling. It is a companion to the Security FAQ and is intended to answer AI-related questions that arrive during customer security and procurement reviews without requiring a per-release or per-commit response.

This document describes RackN's own engineering practices. It does not describe the AI features that DRP ships to an operator; those are documented with the features themselves. This page is reviewed annually.

Practice Statement

RackN engineers use AI assistance across the full range of development work, including code, tests, content packs, and documentation. RackN does not track, label, or gate releases based on whether a given change was AI-assisted, and does not maintain a separate release stream for AI-assisted work. The reason is deliberate: the engineering controls described below — human review, security scanning, and provenance tracking — apply uniformly to every change that reaches a release, regardless of how the first draft was produced. A control that applies to all code needs no AI-specific carve-out, and a control that could be bypassed by relabeling work as "human written" would not be a control at all.

Human Review

Every change that reaches a DRP release is reviewed and approved by a human RackN developer through a merge request. The reviewing developer is accountable for the change: they are expected to understand what the code does, why it does it, and what it affects, and they own the result the same way they would own code they typed themselves. AI-assisted changes go through the identical review path as fully human-written changes — the same reviewers, the same standards, and the same approval requirements. Authorship by an AI tool is not a justification for a change, and "the assistant produced it" is not an accepted answer to a review question.

Security Controls

All DRP code passes through RackN's standard security processes: static application security testing (SAST) and dependency scanning in the CI pipeline, security review of changes that touch authentication, authorization, secret handling, or network exposure, and the CVE tracking and disclosure process described in CVE Summaries. There is no AI-specific exception path and no reduced-scrutiny track. Findings from these processes are handled the same way regardless of how the code that triggered them was written. For the security controls in the product itself, see Security Guide and the Security FAQ.

Training Boundary

No customer data is used to train any AI tool involved in RackN development. Customer configuration, machine inventory, license data, support bundles, and endpoint telemetry are governed by the data handling boundaries described in Remote Access to DRP by RackN and are outside the scope of the development toolchain entirely. RackN does not upload proprietary DRP source code to AI services that train on submitted content. AI assistance is limited to an approved set of platforms, and a contractual guarantee that submitted code and prompts are excluded from model training is a requirement for a platform to be approved. This is a condition of tool selection at RackN, not a per-engineer choice.

Audit and Provenance

Every change to DRP is committed to RackN's GitLab instance with author attribution, a review record, and a merge request history linking the change to the issue that motivated it. That history is the authoritative record of who wrote and who approved any given line of code, and it is retained for the life of the repository. A customer with a contractual or regulatory need for code provenance information on a specific release, component, or fix can request it through RackN support at https://rackn.zendesk.com/hc/en-us/requests/new.

References