How is an AI policy going to help prevent bad faith actors, though?

People who are doing those harmful things with AI aren’t going to stop because of a policy. They are just going to lie and not admit their submissions are AI generated.

At that point, you will still have to review the code and reject it if it is bad quality, just like you had to without an AI policy. The policy doesn’t make it any easier to filter out the bad faith AI submissions.

In fact, if we DO develop an efficient way to weed out the bad faith PRs that lie about using AI, then why do we need the policy at all? Just use that same system to weed out the bad submissions, and just skip the policy completely.

The point of a policy is to make a decision and then communicate that decision, so that you don't end up in a lengthy argument (or make inconsistent decisions) each time a particular situation arises.

You're right that it won't stop anyone doing harmful things with AI - all it does is codify what is and isn't considered acceptable by a project, and make it easier to justify rejections.

If a project wants to continue evaluating submissions on a case-by-base basis (and has the manpower to do it without the support of a policy) then that's entirely their choice, of course.

Some of them will lie. Plenty of people do just follow the rules or are acting in good faith though, so at the very least it can help cut it down.

Policies protect people on the project by making rejection of bad faith actors easier on them (less energy spent, less work needed).

They're also a statement of organizational's support for people who reject slop PRs and help when the AI using author generates a smear blog post against the reviewer like we've seen before.

If the policy will make them at least double check AI didn't put its nonsense in, that's already a win