TLP:AI — A Traffic Light Protocol for AI-Generated Content
Published 31 Mar 2026 · AI:AMBER
I’ve been working on an AI policy for a client’s software project recently, and I needed a way to express something that kept coming up in conversations: not whether AI was involved in producing something, but how much human judgment went into the result.
The binary “AI-generated: yes/no” that most disclosure policies default to is useless. A developer who uses Copilot for autocomplete and a developer who tells an agent “build me a REST API” and merges the result after a cursory glance are both “using AI,” but the epistemic status of their output is radically different. One of them can probably debug what they shipped; the other quite possibly can’t.
So I built a labeling system, loosely inspired by the Traffic Light Protocol, which is commonly used in IT security to indicate how freely a document may be shared.
TLP:AI has five levels, from fully AI-generated to fully human-written:
| Label | Meaning |
|---|---|
| ⚪ AI:WHITE | Written independently, no significant AI involvement. |
| 🟢 AI:GREEN | AI-assisted. Author drove the process, AI used as a tool (autocomplete, partial generation, refactoring help). |
| 🟡 AI:AMBER | AI-generated, fully reviewed line by line. Author can explain every part. |
| 🟠 AI:ORANGE | AI-generated at scale. Architecture and design actively co-developed and understood, hot spots reviewed, but not every line checked. Conscious risk of comprehension debt. |
| 🔴 AI:RED | AI-generated, only checked for plausibility. Draft quality, probably not for production. |
| Bonus level: | |
| ✨ AI:YOLO ✨ | AI-generated, unreviewed. "Hey, it compiled — ship it!" |
In the project where this originated, the rule is: nothing below AI:ORANGE gets merged. AI:RED is for drafts and discussion starters, never for production. AI:ORANGE requires the author to document which parts were reviewed in detail and where comprehension debt exists (code in the project that nobody fully understands).
Side note: this problem isn’t fundamentally new; Stack Overflow copypasta and employee churn have been building comprehension debt forever. But with LLMs you can build a year’s worth of comprehension debt in a week.
Why this matters beyond code
I originally designed this for merge requests, but I think the concept applies more broadly. Blog posts, reports, proposals, talks, policy documents; anything where readers make decisions based on the assumption that a human thought about what they’re reading.
The problem isn’t AI involvement per se. The problem is undisclosed AI involvement that creates a false impression of human judgment. When I read a security analysis, I need to know to what degree someone with domain expertise actually worked through the reasoning, or whether an LLM simply produced plausible-sounding text that nobody actually thought through. The answer changes how much I should trust it.
I use this system on this blog too. This post is AI:AMBER: Claude drafted, I rewrote, and I can defend every sentence. Future posts will carry the same labels.
Try it
The labels work for any context where AI-generated output needs human trust calibration: code reviews, editorial workflows, research papers, consulting deliverables, policy documents. The format is deliberately simple (a colored label and a one-line definition) because adoption matters more than completeness. Take the table above, adapt it to your context, and start using it. That’s it.
If you end up using this system, or if you build something better on top of it, I’d love to hear about it!
Update Mar 31: Added the AI:YOLO level. You know who you are.