The Agent Proposes, the Pipeline Disposes: Controls for AI-Authored Change

The agent's clean pull request was approved quickly, after a fix to a retry helper. However, the change widened the retry window and dropped jitter, creating a thundering herd regression under partial outages. The automated gate caught it because the file lived behind a protected path, not just because the reviewer approved it. This incident made the reporter question their own review process, realizing that simply trusting a change based on its appearance wasn't sufficient.

Human review started to scale poorly as agents were able to open dozens of PRs per hour, each touching different parts of the system. Agents were optimized to pass the smell test, making it difficult for reviewers to effectively vet them. The reporter proposed a solution: moving control out of the human's head and into the pipeline, using provenance records to verify the origin of AI-authored changes.

These records, similar to supply-chain controls, would contain information about the model, prompt, allowed tools, tests run, and more. By enforcing a deny-by-default approach and requiring machine-checkable provenance records, the pipeline could reject changes that lacked this information. Four staged autonomy levels were suggested: Observe (read-only), Recommend (drafts that must be committed by a human), Bounded-write (limited merging authority), and Governed (full authority with attested actions).

These levels would allow agents to gradually earn more autonomy based on a clean track record. However, the reporter acknowledged that provenance provides origin, not correctness, and that gaps in evaluation suites could still pose security risks.