PaperlayerView exact revision on arXiv

Source-linked AI summary

Ethics by Configuration: AI Ethics Principles in Coding Agent Instructions

Haoyu Gao, Peerachai Banyongrakkul, Marc Cheong, Christoph Treude, Sebastian Baltes, Mansooreh Zahedi

arXiv:2610.34847v1cs.SE

TL;DR

This study addresses limited evidence on whether and how ethical principles appear in AI coding-agent configuration files. It analyses a large configuration corpus using validated LLM classification and qualitative coding. Ethics-related statements were common but chiefly concerned development-workflow participants rather than end users or society.

  • Problem

    Systematic evidence is limited on the prevalence of ethics-related statements in agent configurations, the principles they reflect, and the parties they explicitly mention.

    Source: B. Agent Configuration and Project… · p. 3

  • Method

    The study analysed 40,079 configuration files from 8,893 repositories using validated LLM classification and qualitative analysis of 702 samples across 679 files.

    Source: §I · pp. 1–2

  • Results

    39.4% of files and 61.5% of repositories contained ethics-related statements, which appeared more often in task-specific files and chiefly addressed development-workflow participants.

    Source: §I · p. 2

  • Takeaways & Limitations

    The identified considerations mainly concern developers, maintainers, and community members, with end users and society addressed less often.

    Source: §VIII · p. 11

    Because qualitative sampling began with LLM-labelled files, considerations missed by the models could not enter the analysis categories.

    Source: §VII · p. 10

Abstract

from arXiv · show

As AI coding agents become integral to software development, projects increasingly utilise configuration files, such as context files and skills, to govern agent behaviour. While AI ethics principles are widely used in research and policy, little is known about whether and how they are reflected when developers configure coding agents. We studied ethics principles in 40,079 configuration files across 8,893 GitHub repositories. Using a validated large language model (LLM) classification, we measured the prevalence of ethics-related statements, and qualitatively analysed 702 stratified samples across 679 files to uncover the ethical considerations reflected in these files and the parties they concern. Ethics-related statements appeared in 39.4% of files and 61.5% of repositories; concentrated on accountability, transparency, privacy protection, and reliability; and occurred more often in task-specific files such as skills than in project-wide context files. Our qualitative analysis identified 30 categories of ethical considerations, which take the form of concrete rules for the agent. Accountability appeared mainly as requirements for human approval, transparency as explain and honestly report the agent's work, and fairness as accessibility and localisation. These considerations reveal a difference in focus. Whereas public ethics frameworks aim to protect society and end users, configuration files mainly concern developers, maintainers, and community members in the development workflow. Ethics-related content appeared mainly in prose-based files, and whether agents follow these instructions remains untested. We discuss the implications for practitioners, researchers, and policymakers.

I. INTRODUCTION

Ethical guidance in AI coding-agent configurations has been studied only in a small sample, leaving its prevalence and content unclear. Across a large corpus, ethics-related statements were common but focused mainly on developers and other development-workflow participants.

I. INTRODUCTION

  • Existing research had documented only a small number of ethical instructions in agent configurations, leaving their prevalence, principles, and explicitly mentioned parties unknown.The authors frame configuration files as developer-written instructions that can translate ethics principles into directives for agents.Source: §I · p. 1
  • The study extends a prior corpus to 40,079 configuration files from 8,893 repositories and uses Australia’s AI Ethics Principles to classify ethics-related content.It combines prevalence measurement with qualitative analysis of 702 samples across 679 files to identify considerations and explicitly mentioned parties.Source: §I · pp. 1–2
  • 39.4% of files and 61.5% of repositories contained ethics-related statements, concentrated on accountability, transparency and explainability, privacy protection and security, and reliability and safety.These statements appeared more often in task-specific files than in project-wide context files.Source: §I · p. 2
  • The paper contributes a validated LLM classification approach, a categorisation of ethical considerations in configurations, and actionable implications for stakeholders.Its classification covers ethics relevance and principle assignment.Source: §I · p. 2

II. RELATED WORK

Prior work examines ethical values in software practice, documentation, and open-source AI-use guidance, while systematic evidence about ethics in agent configuration remains limited. This study addresses that gap by measuring prevalence and analysing expressed concerns and named parties.

A. Ethics in Software Engineering

  • Software-engineering research identifies challenges translating ethical values into practice, including differing interpretations and limited operationalisation in implementation and testing.Prior approaches include ethical user stories, responsible-AI patterns, and trustworthiness dimensions for engineers.Source: A. Ethics in Software Engineering · p. 2
  • Documentation studies examine disclosures, restrictions, and mitigation advice, while Treude et al. found six examples of ethical agent instructions in 25 repositories.These examples included fairness, accessibility, and sustainability concerns.Source: A. Ethics in Software Engineering · p. 2

B. Agent Configuration and Project Documentation

  • Open-source project guidance addresses AI-use disclosure, limits on AI involvement, verification, and contributor responsibility.Prior work also characterises governance strategies around accountability and maintainer workload.Source: B. Agent Configuration and Project… · p. 2
  • Research on agent configurations has described context files, eight configuration mechanisms, and reusable skills, but systematic evidence on ethics prevalence, considerations, and named parties remains limited.This study extends Galster et al.’s corpus and applies Australia’s AI Ethics Principles to address those gaps.Source: B. Agent Configuration and Project… · pp. 2–3

III. METHODOLOGY

The study extends a corpus of open-source agent configurations and evaluates ethics-related content against Australia’s AI Ethics Principles. It uses a staged, human-validated LLM classification process to support prevalence and principle-level analyses.

III. METHODOLOGY

  • The study asks how prevalent ethics-related statements are, how repositories cover principles across configurations, and what considerations and parties the configurations reflect.Figure 1 overviews data collection, ethics classification, and analyses addressing these questions.Source: §III · p. 3, Figure 1 · p. 4

A. Dataset and Ethics Construct

  • The corpus contains 40,079 English-language configuration files collected from eligible open-source repositories, and the study uses Australia’s eight voluntary AI Ethics Principles as its reference framework.The authors note that content aligned with a principle may reflect software-engineering practice rather than an explicitly ethical motivation.Source: A. Dataset and Ethics Construct · p. 3

B. LLM-assisted Ethics Classification

  • Two open-source LLMs classified configuration sections for ethics relevance and applicable principles, with files marked relevant when either model identified relevant content.Human validation and prompt refinement improved held-out agreement; the Stage 2 prompt raised principle-level F1 from 0.84 to 0.89 while weighted ethics-relevance F1 shifted from 0.88 to 0.87.Source: B. LLM-assisted Ethics Classification · pp. 3–4

C. Qualitative Analysis for Ethics Considerations

The qualitative analysis sampled classified files across the eight ethics principles, coded ethical considerations, and recorded the parties explicitly mentioned in excerpts. It produced 125 codes grouped into 30 categories.

C. Qualitative Analysis for Ethics Considerations

  • The analysis sampled 702 excerpts across 679 files, drawing a per-principle stratified sample and continuing coding until the required number of relevant files was reached.Some sampled files did not concern the principle for which they were selected because classification was imperfect.Source: C. Qualitative Analysis for Ethics… · p. 4
  • Two authors jointly coded 15 files per principle before the first author coded the remaining files, using deductive and inductive coding to develop categories.The eight principles formed the fixed top-level structure, while codes emerged from the data and were merged into categories.Source: C. Qualitative Analysis for Ethics… · p. 4
  • The researchers recorded parties named in excerpts using their own terms, grouped them into six broadly construed parties, and distinguished end users from library users.Each file counted once per party named in its excerpts; files without a named party were marked as cannot infer.Source: C. Qualitative Analysis for Ethics… · p. 4

IV. PREVALENCE OF ETHICS STATEMENTS (RQ1)

Ethics-related statements occur in a substantial share of configuration files and repositories, but coverage is concentrated in four principles and more common in task-specific files. Repositories covering many principles tend to accumulate them across task-specific files rather than rely on one project-wide statement.

IV. PREVALENCE OF ETHICS STATEMENTS (RQ1)

  • 39.4% of files contained ethics-related statements; accountability led at 20.6%, followed by transparency at 16.0%, privacy and security at 15.1%, and reliability and safety at 14.4%.Fairness appeared in 5.6% of files; contestability and human-centred values each appeared in 1.2%, and wellbeing in 0.6%.Source: §IV · p. 5
  • Ethics-related statements appeared in 64.2% of subagent files, 57.1% of command files, and 55.8% of skill files, versus 37.1% of context files and 33.0% of rules files.Settings, hooks, and MCP configurations contained such statements less often; MCP configurations were at 1.2%.Source: §IV · p. 5
  • Skills referenced accountability, transparency, and reliability more often than context files, while privacy and security was similarly common in both.The respective skill-versus-context rates were 36.3% versus 17.0%, 27.1% versus 14.3%, and 22.2% versus 13.0%; privacy and security was 14.3% versus 16.7%.Source: §IV · p. 5
  • 61.5% of repositories contained an ethics-related file, but principle coverage was narrow, with a median of two principles among those repositories.Repositories covering all eight principles tended to contain more ethics-related skills alongside context files; in those repositories, context files averaged 4.6 principles and skills 6.7.Source: §IV · pp. 5–6

V. ETHICAL CONSIDERATIONS AND PARTIES (RQ2)

The qualitative analysis identified 30 categories of ethical considerations comprising 125 codes. Accountability chiefly requires human oversight, most often approval before an agent acts, while deeper human involvement is less common.

A. Ethical Considerations

1) Accountability:

  • Accountability is the most common principle and requires identifiable responsibility for AI outcomes and human oversight.Its categories range from approval and decision-making to review and human ownership of the final contribution.Source: 1) Accountability · p. 6
  • Human approval before an agent proceeds is the largest accountability category, especially for proposed changes and irreversible or external actions.Approval can also gate whether self-written skills are loaded, preventing untrusted agent output from entering the prompt.Source: 1) Accountability · p. 6
  • Accountability asks humans for progressively greater involvement, from approval through decisions and review to owning the contribution.Approval or decision-making is more common than post-hoc review or contribution ownership.Source: 1) Accountability · p. 6

2) Transparency and Explainability:

Transparency instructions ask agents to explain their work and report its limits and failures, while disclosure of AI involvement is less common and can be contradicted. Privacy and security rules address secrets, untrusted inputs, security-critical changes, and access.

2) Transparency and Explainability:

  • Transparency rules most often require agents to summarise changes and explain why, making work understandable to reviewers and future maintainers.Some also require warning users about consequences, such as reporting an impact analysis before editing.Source: 2) Transparency and Explainability · p. 6
  • Agents are instructed to distinguish observations from inferences, state result limits and unchecked work, and report failures or skipped steps rather than present incomplete work as done.One instruction distinguishes compiled output from tested or verified output.Source: 2) Transparency and Explainability · p. 6
  • Disclosure of AI involvement is less common than explaining work or reporting failures, and it is the only transparency requirement with opposing directives.Some configurations require attribution, while others remove traces of AI involvement.Source: 2) Transparency and Explainability · p. 6

3) Privacy Protection and Security:

  • Privacy rules mainly keep secrets such as API keys, tokens, and passwords out of commits, logs, error messages, and other output.Some configurations restrict credentials to a command so they do not appear in conversation logs or shell history.Source: 3) Privacy Protection and Security · pp. 6–7
  • Security instructions treat outside input and code cautiously, prioritise security-critical changes, and restrict access and privileges.Some also limit the agent’s own tools or prohibit it from changing CI workflows autonomously.Source: 3) Privacy Protection and Security · p. 7

4) Reliability and Safety:

Reliability and safety rules constrain how agents work and the software they produce, including avoiding damage and verifying changes. Fairness is expressed through localization and accessibility, while the analysed files contained no instructions about unfair discrimination or bias.

4) Reliability and Safety:

  • Reliability and safety rules ask agents to limit changes, preserve recoverability, and avoid irreversible operations that could damage work.Some rules address shared resources, such as avoiding branch switches that disrupt a colleague’s running job.Source: 4) Reliability and Safety · p. 7
  • Before delivery, agents should run checks, test changes, avoid guessing, and not weaken tests or claim unrun checks passed.The rules also reject changing CI workflows merely to evade a failure.Source: 4) Reliability and Safety · p. 7
  • Reliability and safety also cover preserving interfaces and data integrity and making software fail safely on errors.The rules concern both the agent’s work process and the software it produces.Source: 4) Reliability and Safety · p. 7

5) Fairness:

  • Fairness instructions focus on localization, accessibility, and supporting users with different skill levels; none of the 93 analysed files concerned discrimination or bias.Examples include translating visible strings and supporting keyboard navigation, screen readers, contrast, and alternative text.Source: 5) Fairness · pp. 7–8

6) Contestability:

Contestability rules let users and contributors challenge agent decisions, reverse or correct outputs, and route unresolved disputes to humans. Human-centred values chiefly protect people’s autonomy, including developers’ ownership of their work and end users’ freedom to choose.

6) Contestability:

  • Contestability rules open agent decisions to objection, often by reporting judgment calls users can override and explaining how contributors can appeal.One review agent must present its findings as starting points for discussion, not verdicts.Source: 6) Contestability · p. 8
  • Users can reject suggestions, undo changes, and request revisions; unresolved disputes should be re-examined and left to humans.One review agent escalates a disagreement to a code owner once, then stops.Source: 6) Contestability · p. 8

7) Human-centred Values:

  • Human-centred rules protect people’s authorship by preserving their intent and style, offering options, and supporting learning rather than taking over the work.Some projects also require human-written community contributions.Source: 7) Human-centred Values · p. 8
  • Rules for autonomy include respecting opt-outs, skipped steps, user-set values, and consent, while inclusive-treatment instructions address people’s differences.The section concludes that these rules protect both developers’ ownership of their thinking and work and end users’ freedom to choose.Source: 7) Human-centred Values · p. 8

8) Human, Social and Environmental Wellbeing:

Wellbeing considerations express care for the people and resources around agent work, while the parties named across ethical considerations are concentrated in the open-source development process. End users, society, and the environment receive less attention overall, with end users standing out in fairness.

8) Human, Social and Environmental Wellbeing:

  • Wellbeing is the least common principle, yet its rules address burdens on project communities, resource costs, societal harms, and software users’ comfort and safety.Examples include limiting an agent to 10 pull requests per day per operator and avoiding interface elements that encourage continuous screen staring.Source: 8) Human, Social and Environmental… · p. 8

B. Mentioned Parties

  • Developers, maintainers, and community members are the most-mentioned parties overall, while software users are addressed less often and society and the environment least often.Developers are the majority for accountability (77%), contestability (57%), human-centred values (55%), and transparency (53%).Source: B. Mentioned Parties · p. 9
  • End users stand out in fairness (63%), where considerations concern accessibility and localisation; library users appear mainly in fairness and reliability and safety.Community members appear mostly in wellbeing, contestability, and human-centred values, while society and the environment appear almost exclusively in wellbeing.Source: B. Mentioned Parties · p. 9

VI. DISCUSSION AND IMPLICATIONS

The discussion finds that configuration rules make ethics principles concrete but focus chiefly on the immediate development workflow rather than the broader protection goals of public frameworks. It highlights gaps in human review, disclosure, and enforcement, and outlines implications for practitioners, researchers, and policymakers.

A. Discussion

  • Configuration files focus on the immediate open-source workflow, unlike public frameworks’ emphasis on protecting end users and society; fairness rules narrow to accessibility and localisation.None of the 93 analysed fairness-related files addresses algorithmic bias or unfair discrimination, and concrete rules may stand in for broader concerns behind a principle.Source: A. Discussion · p. 9
  • Accountability rules usually place humans before the agent acts, while far fewer require output review; transparency rules on AI credit conflict, with some requiring disclosure and others concealment.The authors caution that quick approval may create a sense of control without catching flawed output, and did not check projects’ contribution guidelines.Source: A. Discussion · p. 9
  • Ethics statements occur more often in task-specific files than context files, but are mostly prose; compliance and the relative effectiveness of task-specific instructions remain untested.Hooks, permission settings, and MCP configurations rarely contain detected ethics-related statements.Source: A. Discussion · pp. 9–10

B. Implications

  • For practitioners, the authors suggest adding post-execution review, pairing prose with enforceable controls, and aligning AI-credit instructions with contribution policies.They note that whether suggested settings prevent leaks in practice was not tested.Source: B. Implications · p. 10
  • For researchers, the authors propose situated open-source benchmarks that test ethical behaviour and longitudinal studies of whether instructions stay current or gain enforcement.They also suggest mining commits and pull requests to assess disclosure of AI involvement against project policies.Source: B. Implications · p. 10
  • For policymakers, the authors suggest guidance with examples of how each principle applies when configuring coding agents.Their rationale is that existing frameworks are top-down, while coding-agent configurations provide a bottom-up setting for reflecting principles.Source: B. Implications · p. 10

VII. THREATS TO VALIDITY

The study reports ethics-related statements in coding-agent configurations and identifies limitations in how those statements are classified, sampled, and scoped. Its conclusion is that the observed rules mainly concern development-workflow participants rather than end users or society.

VII. THREATS TO VALIDITY

  • Principle boundaries and abstraction levels overlap, so assigning statements to the most specific principle operationalised may yield different classifications and categories under alternative interpretations.Three authors agreed on the rule and recurring boundary cases, but alternative interpretations may still differ.Source: §VII · p. 10
  • LLM classification and qualitative sampling may miss ethics-related content, including constraints expressed through code or commands rather than prose.The qualitative sample drew from LLM-labelled files, and only explicitly mentioned parties were recorded.Source: §VII · p. 10
  • The public GitHub corpus may not represent private or industrial projects, and configuration files show developer instructions rather than agent behaviour.The corpus reflects five coding tools and eight configuration mechanisms as of August 2026.Source: §VII · p. 10

VIII. CONCLUSION

  • Ethics-related statements appeared in 39.4% of files and 61.5% of repositories; qualitative analysis found 30 categories of concrete rules, mainly concerning development-workflow participants.The rules appeared predominantly in prose-based configuration files.Source: §VIII · pp. 10–11
  • Accountability mainly meant requiring human approval, while fairness mainly concerned accessibility and localisation; the qualitative sample contained no discrimination-related instructions.These are examples of the concrete rules identified in the conclusion.Source: §VIII · p. 11

Related papers

Loading 2610.34847v1…