The Agent Proposes, the Pipeline Disposes: Controls for AI-Authored Change

When agents write code and open pull requests faster than humans can read them, ‘the diff looked fine’ stops being a control. The durable controls live outside the agent’s reasoning loop.

TL;DR - Key Takeaways

• Human review does not scale when coding agents can generate large volumes of convincing pull requests.
• AI-authored changes should be treated as artifacts from an untrusted producer and required to prove provenance before review.
• Signed attestations can record the model, task specification, allowed tools, tests and evaluations behind each change.
• Independent eval suites matter because agents should not be able to certify their own work by changing the tests.

The pull request was clean. Tight commit message, a one-line fix to a retry helper, green checks. I approved it in the time it takes to drink coffee. It came from an agent we’d wired into our workflow to chew through flaky-test toil, and it had done exactly that all week.

What I almost missed: The change widened the retry window and dropped the jitter on a client that fans out to a downstream service we don’t own. Under normal load, invisible. Under a partial outage, that’s a synchronized retry storm - the kind of thundering-herd regression that reads as one removed line and behaves as an incident. A change-budget gate caught it because the file lived behind a protected path, not because I did. I’d already clicked approve.

That was the moment I stopped trusting my own review as a control. Not because the agent was bad but because it was good enough that the diff looked fine, and ‘the diff looked fine’ is not a control; it’s a vibe.

Why Human Review Stopped Scaling

Code review was designed around a human bottleneck. One engineer writes a few hundred lines a day, another reads them and the slowness is load-bearing - it’s the rate limit that keeps the queue legible. Agents delete that assumption. A single agent can open a dozen PRs an hour, each individually plausible, each touching a different corner of the system.

Plausible is the problem. Agent-authored changes are optimized to pass the smell test. They have clean names, reasonable commit messages and tests that go green, because the agent can see the test suite and write to it. A reviewer scanning 20 of these a day is not really reviewing - they’re rubber-stamping with extra steps, and they’ll wave through the one that matters because it looks like the 19 that didn’t.

You cannot fix this by reviewing harder. The bottleneck you removed isn’t coming back. You fix it by moving the control out of the human’s head and into the pipeline, where it runs the same way on PR number 1 and PR number 200.

Provenance is the New Gate

Here’s the uncomfortable reframe: An AI-authored change is an artifact from an untrusted producer, and we already know how to handle those. We’ve spent years building supply-chain controls for exactly this shape of problem - code entering the pipeline from somewhere you don’t fully trust, that you need to verify before you act on it.

The supply-chain world settled on a clear idea: Don’t trust the artifact, verify its provenance. The SLSA framework formalizes this as a signed attestation that travels with an artifact and answers how it was produced. The in-toto project gives you the attestation format. Sigstore gives you the signing and verification. None of this was built for agents, and all of it applies directly.

So make every agent-authored change carry a provenance record, and make that record machine-checkable. Not a label a human reads - a signed attestation the pipeline enforces. Which model and version produced this change? What prompt or task spec drove it? Which tools was it allowed to call? Which tests and evals gated it? What they returned? If the change shows up without that record, it doesn’t get reviewed. It gets rejected at the door.

This is the inversion that matters. The default is deny. The agent earns its way into the human queue by proving where the change came from, not by looking convincing.

The Gate, in About 20 Lines

The control I trust is boring on purpose. A pipeline stage, vendor-neutral, that refuses to advance an AI-authored change unless it carries a verifiable provenance attestation and clears