Grade Outcomes, Not Usage: Why Mandates Corrupt the Attribution Record

In August 2025, Coinbase CEO Brian Armstrong fired engineers who had not onboarded to Copilot or Cursor by an end-of-week deadline. The enforcement signal was onboarding telemetry, not the quality of anyone's work. Companies are grading AI usage, usage is the wrong metric, and grading it corrupts the attribution record that review and compliance depend on.

A rollout is the last step of running coding agents as shared team infrastructure, and the mandate is the failure mode that step keeps reaching for. The rest of this section builds a workflow whose value lives in outcomes: scoped work, closed feedback loops, decision gates, and a per-actor trail that says what was asked, what the agent did, and who approved it. Grading usage measures none of that, and pointing a performance score at the same trail turns the audit record into a surveillance tool.

The mandates grade activation, not outcomes

Microsoft's June 2025 internal memo from Julia Liuson, CVP of the Developer Division, declared "Using AI is no longer optional - it's core to every role and every level," telling managers to weigh AI usage in performance reflections. Shopify's Tobi Lütke made "reflexive AI usage" a baseline expectation, added AI questions to performance and peer reviews, and required teams to prove AI cannot do a job before requesting headcount.

What gets measured is whatever the telemetry already emits, and none of it is an outcome.

The consequences are already employment events. A contractor reported being let go for "not leveraging AI agents enough" (126 points on r/ExperiencedDevs). Another engineer was told by a boss that his code looked "handcrafted", the word now doing duty as a mild pejorative.

Usage is not a proxy for productivity

The METR randomized trial is the cleanest evidence that usage and self-report both fail. Experienced open-source developers were 19% slower with AI tools, yet "developers expected AI to speed them up by 24%, and even after experiencing the slowdown, they still believed AI had sped them up by 20%". A metric built on "did they use it" inherits exactly that miscalibration.

Sentiment data points the same way. The Stack Overflow 2025 survey (49,009 respondents) found 84% of developers using or planning to use AI while 46% actively distrust its accuracy and only 3% highly trust it. High usage alongside high distrust means usage measures pressure, not conviction, and certainly not output quality. (That 46% is distrust of AI accuracy, not of monitoring; no survey isolating developer attitudes toward AI-usage tracking specifically exists yet. The nearest data is general workforce: 56% of monitored employees report stress or anxiety from surveillance.)

Scoring the record corrupts the record

Commit attribution is genuinely load-bearing. The Moonwell hack, $2M stolen from a protocol holding $100M+, was traced to a bug "introduced in a commit that was co-authored by Claude": the trailer was the forensic mechanism. Reviewers want it for calibration ("the source matters. If you outsourced the code writing to some guy named Bob on Fiverr, I'd want to know that too," HN).

The moment attribution feeds a performance score, people optimize the attribution instead of the work, in both directions. HN predicted it plainly: shaming AI disclosure will "make people disable Claude attribution on their commits to avoid drama," and "the slop-pushers are most aggressive about stripping the AI attribution anyway." Disabling it is two lines of settings.json. Meanwhile Cursor users under usage mandates ask the inverse question: how to evade per-commit AI-percentage metrics entirely. Either way, git blame stops meaning anything, which defeats the audit purpose the trail was built for. (That last step is inference from the community record, not a measured result.)

There is also a legal collision the mandate trend has not priced in. The same per-actor tables serve the audit trail and the performance pipeline, and EU employment law regulates exactly that convergence: CNIL fined Amazon France Logistique 32M euros for per-event worker telemetry, and German template works-council agreements generally bar individual-level evaluation of AI usage data. See works councils and what is logged about you.

Measure outcomes, at team level, with the trail purpose-bound

Three substitutions fix most of the damage:

• Aggregate by default, individual by exception. The SPACE framework's first guardrail is "review all metrics at the team level, never individual." GitHub already suppresses team aggregates below 5 members. Per-actor queries are for compliance roles, logged, break-glass.
• Grade outcomes, not inputs. Revert rates, escaped defects, cycle time: the numbers that actually moved at the companies in the published record. Measuring outcomes covers what those look like; cohorts beat mandates covers driving adoption without a KPI.
• Reframe attribution as the engineer's shield. A trail showing what was asked, what the AI did, and who approved it is the evidence that protects the developer when something breaks; the git blame distortion complaint is really a complaint about a record that assigns blame without context. That trail is the same artifact attribution binds to a person and accountability stays human holds the shipper to. It threatens people only when it is secret, individually scored, and purpose-unbound. Remove those three properties and the same data builds trust instead of eroding it.

The Linux kernel got the balance right: an Assisted-by: tag recording model and tooling, no AI ever gets a Signed-off-by, and the human signs for the patch. Disclosure is policy, accountability sits on a person, and no one's prompt count reaches a dashboard.