Controlling and disabling AI

[JasonTheAdams]

Within the WordPress as an AI Fundamental post, multiple people have expressed concerns around AI models being accessible from WordPress, and would like the ability to disable it entirely — and, at the very least, strictly control it. Especially for sites that house sensitive data, I can see this being a very sensible use case.

Let's use this issue to discuss ways we can do this that allows developers to gracefully hide AI-powered features for such sites.

[JasonTheAdams]

My first thought here is to leverage the Prompt_Builder::supports_x() methods, which developers are encouraged to check at present. I'm thinking we can add two checks that provide control:

1. A hook which runs in both the support and generate methods
2. Custom use_ai user capability check

Custom Hook
The hook simply acts as a kill switch. It would be a boolean filter than is true by default. If false in the support method, it returns false; if false in the generate method, it throws an exception or WP_Error. In both cases, let's pass the context of the prompt in case the developers want to limit a subset of prompts (e.g. text generation only is fine).

Custom Capability Check
Here, I'm imagining a use_ai capability check that's very primitive and, by default, is added to every kind of user role. Developers could remove said capability for specific roles (and/or we could have a filter there, too) to restrict AI access to specific roles.

Now, this doesn't address unauthenticated users. That, I suppose, could be another hook which permits unauthenticated users by default, and can be set to false to prevent unauthenticated AI usage. Perhaps this should be false by default.

I'm just trying to get the ball rolling on this one. I'm not attached to these ideas. I'm more invested in coming up with a safe, secure solution that helps folks feel more confident.

[jeffpaul]

Let's use this issue to discuss ways we can do this that allows developers to gracefully hide AI-powered features for such sites.

Given you'd have to have the AI Experiments plugin active (or some other plugin / custom code that's leveraging the WP AI Client), is this primarily a question of being able to hide certain service providers and/or experiments so someone can NOT enable/configure them?

[JasonTheAdams]

@jeffpaul I don't think so. I believe this is in anticipation of the WP AI Client coming to WordPress in 7.0. I don't think it's about specific experiments, though I could see having control over which providers are available potentially being important to this conversation. In any case, that's why I'm surfacing the conversation here and not in the AI Experiments repo. I believe it has to do with running arbitrary AI prompts (especially passing data to said models) in 7.0 and later.

[felixarntz]

@JasonTheAdams Can you elaborate on what the concrete ask or concern is? Is this about disabling AI entirely, or is it about disabling certain models or certain providers (but leave AI allowed when using other models/providers)?

[JasonTheAdams]

From the comments I've seen, it's about controlling the usage of AI in sensitive contexts. This could be preventing AI calls entirely, preventing specific modalities, limiting to certain providers, etc.

My inclination is to start on the simpler side of things, giving folks the ability to prevent AI entirely on a site, and terminating specific prompts. I'd rather not get too complex/specific until clearer use cases come in.