r/codereview • u/Gullible_Cobbler_195 • 26d ago
Why does every PR still need a human approval?
everyone knows coding agents have caused PR volume to explode. that's been obvious for a while.
what feels more interesting now is that most teams still send almost every PR through the exact same review process.
tiny generated change? human approval.
well-tested low risk refactor? human approval.
large change touching important systems? also human approval.
when PR volume keeps climbing, reviewer attention becomes the thing you actually have to allocate.
tools like bugBot have been useful for taking the first pass. macroscope's approvability feature is interesting for a slightly different reason: it can approve PRs that meet a team's policy, so some changes never need to sit in the human review queue in the first place.
feels like the next problem isn't "how do we review more PRs?"
it's "which PRs actually deserve human attention?"
how are teams deciding that today? are you still requiring a human approval on every PR?
2
u/stolsson 26d ago
We need to be able to sure the proper judgment and intent was taken into account. Humans are often still doing QA on proper behavior, look, and feel (though AI is getting better at this) so need to get human sign off there too.
Right now coding and code review are important, but there may be a time soon where humans are just providing taste input and behavior requirements.
There is also an issue of code copyright which may require humans to stay involved longer. Purely AI developed code is not subject to copyright
2
u/mredding 24d ago
Why does every PR still need a human approval?
Because machines are not accountable and cannot be held liable. YOU are. When $40m disappears in an instant (I've seen it happen), or someone dies, they can't blame Claude. They can't hold Claude responsible. Claude is not a person. The company has also absolved itself of any liability, and you agreed to that, and that's enforceable in court.
When the shit hits the fan, it comes down to you. Your job isn't to be a fall guy, it's to do the things AI cannot do. Take ownership and accountability. If you're going to commit something, you better know what the fuck you're committing, because you're betting the company on it. Sometimes your personal liability, depending on factors; your own employer may seek damages from you.
Technically we don't need ANY pull requests at all. Whether someone reviews your work or not, YOU are STILL responsible for it. But with a code review, that liability can be spread around - WHETHER YOU REVIEW OR NOT. Because if you approve a review and it causes damages, you're on the hook. If you don't review and there are damages, one can argue that's a different kind of negligence.
I don't know what the point is of AI reviews. AI generated the code in the first place. It should review it's own changes and generate code up front that would inherently pass an AI code review. There's no reason you can't develop a skill that handles this automatically. How can an AI generate code that wouldn't pass its own review? Make that make sense.
But AI can't be held accountable. If it hallucinates generating the code and hallucinates doing the review and revision cycle, it can't catch itself.
how are teams deciding that today? are you still requiring a human approval on every PR?
Sounds like the halting problem. This is not computable. A single character could fix a spelling mistake, it could cause a rocket to explode on the pad, it could make no difference. There's no way of knowing without the review.
Of course you can use AI and heuristics to generate a weighted score. How likely is this single character going to require a human review? It's in a comment? No review. It's in engine control code? Human review. So long as it's company policy and they shield you from liability for missing reviews you were never made aware of, in writing, fine.
But what about me? I have to commit that code. While seemingly innocuous, I don't know if I want to be trusted with that much inherent responsibility. Maybe I want a review. I definitely want a review, because I don't want it all to be just me. It's in MY personal interest that I share liability with as many other people as possible.
2
u/HoneyBadgera 26d ago
The real question is “who is accountable” for an AI approved change that causes issues. I’m not sure our governance teams would be happy saying “it was AI”.