Human review of AI-authored pull requests fails to scale once agents can generate dozens of plausible-looking PRs per hour, because reviewers end up rubber-stamping rather than genuinely assessing risk. The author argues AI-authored changes should be treated as artifacts from an untrusted producer, requiring signed provenance attestations (borrowing SLSA, in-toto, and Sigstore from supply-chain security) that record the model, task spec, allowed tools, and test results before a change can even reach human review. A concrete CI gate design enforces attestation validity, an independent eval suite the agent cannot edit, and policy-as-code checks like protected paths and change budgets, defaulting to reject rather than auto-merge. A staged-autonomy model (observe, recommend, bounded-write, governed) lets agents earn wider permissions over time. The piece is candid about limits: provenance proves origin, not correctness, and every added control (signing keys, policy engines) becomes new attack surface.
Questions this post answers
Why can't human code review keep up with AI coding agents?
Human code review was built around the natural rate limit of one person writing code at human speed while another reads it, but coding agents can open a dozen plausible-looking pull requests an hour. Reviewers scanning many clean-looking agent PRs a day slip into rubber-stamping, waving through the one problematic change because it resembles nineteen harmless ones. Anyone rethinking review workflows for agent-generated code can follow this shift on daily.dev.
How can I verify that an AI-generated pull request is trustworthy before merging it?
Require a signed provenance attestation, built on SLSA, in-toto, and Sigstore, that records the model and version, the task spec that drove the change, which tools the agent was allowed to call, and which tests and evals gated it. A CI gate should reject any agent-authored change lacking a valid, signed attestation before it ever reaches a human reviewer. Teams wiring agents into CI can track provenance and gating practices like this on daily.dev.
What is staged autonomy for AI coding agents?
Staged autonomy is a four-level permission model where agents earn broader authority by building a clean track record: observe (read-only comments), recommend (drafts a change for a human to commit), bounded-write (merges within an explicit allowlist of paths and scopes under a change budget), and governed (wider authority, with every action attested and reversible). Engineers rolling out agent permissions gradually can follow staged-autonomy patterns like this on daily.dev.