Open Source Summit India 2026

Open source projects are rapidly adopting AI agents for code review, issue triage, PR merging, and sprint planning. But most projects bolt agents on without asking: who audits what the agent did? What happens when an agent merges malicious code? Who is liable when an AI recommendation violates a contributor agreement?

Drawing from GitMesh - an LF-incubated project running production AI agents for engineering workflows - this talk covers the three non-negotiable pillars every open source project needs before deploying agents:

• Audit trails: every AI decision logged, attributed, and reversible
• Policy enforcement: agents operating within explicitly defined
contributor permissions and DCO boundaries
• Human-in-the-loop gates: approval workflows that preserve maintainer accountability without killing automation speed

I'll share what broke when we skipped these, how we fixed it, and the open-source tools (OPA, Sigstore, audit logging patterns) any project can adopt today. Attendees leave with a practical compliance checklist for AI-assisted open source governance.