Data Source functions should be declared as nondeterministic.

[blkt]

REGO functions can be declared as Nondeterministic which allows REGO runtime to behave correctly in some cases. Here's an excerpt of the documentation (golang specific here).

Since this built-in could have non-deterministic results, depending on network conditions, the declaration also sets rego.Function#Nondeterministic to true. This provides basic safety information to the runtime, so that the function isn’t accidentally run during bundle builds or partial evaluation. If your builtin can have non-deterministic results, you should mark it appropriately to avoid surprises.

Given we don't really know the nature of the functions being defined by the users, it could be a good idea to mark them as Nondeterministic here.