Add a consistent trailer line at the end of each commit message that records AI assistance, for example a Co-authored-by line or a custom trailer, and check it with a commit hook. A label helps reviewers and auditors find AI-assisted changes, but it is self-reported and proves nothing on its own.
Why label at all
When a defect or license question surfaces months later, you want to answer "was this written with an assistant, and which one?" Labels also let you compare defect rates and review time between assisted and unassisted changes, which is how you judge whether a policy is working.
The trailer format
GitHub documents the Co-authored-by trailer: one line per co-author, in the form name and email, placed at the end of the commit message after a blank line.
Add rate limiting to login endpoint
Co-authored-by: Example Assistant <assistant@example.com>
Use an address tied to an account if you want GitHub to attribute the commit to that account. For tools without an account, many teams prefer a custom trailer such as AI-Assisted: tool-name, which is plain text and does not claim human co-authorship.
Options compared
| Option | Pros | Cons |
|---|---|---|
| Co-authored-by trailer | Familiar, shown by GitHub | Implies a person, email handling |
| Custom trailer | Clear meaning, easy to query | Not shown specially in the UI |
| Pull request label | Easy to apply | Not stored in git history |
| Branch naming | No tooling needed | Easy to forget |
| Tool-generated trailer | Consistent | Depends on tool support |
Make it checkable
- Pick one format and document it in the policy.
- Add a commit message hook or CI check that rejects commits missing the trailer when the pull request carries an AI label.
- Query the history with
git log --grepor a trailer filter during reviews. - Sample a few unlabeled changes each quarter to see whether labeling is honest.
What a label cannot do
It cannot detect unlabeled use. Developers can copy from a chat window and commit with no trace. Labels reduce ambiguity for people acting in good faith. They are not detection, and they should not be your only control. Review, tests and security checks still apply to every change.
Quick check
Is a Co-authored-by trailer the same as legal authorship?
No. It is a git attribution convention. Legal and licensing questions need their own review.
Should every assisted commit be labeled?
Decide by policy. Many teams label anything where generated code was accepted beyond trivial autocomplete.
Safeguard keeps evidence and records for compliance reviews through compliance and evidence automation. Run a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
