AI coding governance
What is AI-agent change control?
A practical control boundary between an autonomous coding run and the moment a human reviewer is asked to trust its output.
AI-agent change control is a pre-review workflow that checks an agent’s authorized scope, observed repository changes, declared verification, sensitive surfaces, and missing evidence before its code enters human review.
Why ordinary code review starts too late
A pull-request diff shows the resulting code. It does not reliably show what the agent was authorized to do, whether the repository was already dirty, which commands actually ran, whether sensitive files require approval, or which parts of the agent’s summary are supported by evidence.
That creates a review-readiness problem. Reviewers spend their first minutes reconstructing the run instead of judging the change. Green CI helps, but it answers whether configured checks passed—not whether the work arrived with a trustworthy boundary and complete enough evidence.
The five parts of a useful control boundary
- Authorized scope: the human-approved objective and surfaces the agent may change.
- Observed change: the repository delta attributed to the bounded session.
- Verification evidence: the declared commands and their recorded pass or failure state.
- Sensitive-surface policy: explicit treatment of auth, secrets, infrastructure, deployment, customer data, payments, or external mutation.
- Review decision: begin review, block for evidence, or request human approval—with the reason preserved.
Change control is not code correctness
A valid control record cannot prove that generated code is correct. Tests can be incomplete, requirements can be misunderstood, and an authorized change can still contain a bug. The control record should say exactly what it proves and what remains unknown.
| It can establish | It cannot establish |
|---|---|
| Observed scope and files changed | Absence of all bugs |
| Declared checks passed or failed | Complete semantic correctness |
| Sensitive surfaces were identified | Production safety or compliance |
| Evidence and gaps are explicit | Business value or ROI |
Where the gate belongs
The first useful enforcement point is immediately before AI-agent PR review. The agent finishes its bounded session, the local gate evaluates the recorded evidence, and the reviewer receives a decision before opening raw chat or beginning line-by-line review.
The operating rule is simple: no valid Run Control Receipt, no AI-agent PR review. A failed receipt is not a verdict on the code. It means the work is not yet ready to consume reviewer attention as a reviewable change.
How to introduce it without creating ceremony
Start with one active repository and one real control problem. Name the reviewer, verification commands, sensitive surfaces, approval owner, and evidence-retention path. Run the gate for two weeks and record whether each block caught useful missing evidence or merely repeated information the team already had.
The pilot is valuable only if it changes a real review or security decision. If reviewers ignore the receipt, blocks are confusing, or no one will enforce the rule afterward, the workflow has not demonstrated product value.
Related guide
Use the AI-generated code review checklist to turn this control model into a concrete pre-review workflow.