- Gautam Korlam said reviewers who cannot keep up with agent-written pull requests often just stamp approval, and old CI logs expire.
- He argued that sensitive industries need a durable record of what was checked, or they cannot show what happened in an audit.
AI agents can write code faster than people can review it. Approvals then risk becoming empty gestures. Gautam Korlam made that point on the AI Engineer show. He worked on Uber's SubmitQueue and on Gitar, now part of Sonar. His warning is simple. An approval with no record of what was checked cannot prove diligence later.
What was said
Korlam said Uber faced agent-scale commit volumes before agents existed. The systems that test, review and merge code were built for human speed. They cannot cope when agents arrive.
Review is one place where the strain shows. Korlam said many people in the industry now approve pull requests automatically. They cannot keep up. They lean on other signals to cope with the flow.
A second problem sits underneath. Build and test records expire. Old logs vanish once their retention period ends. Korlam put it bluntly: "There is no note about what exactly was checked, there is only a stamp of approval."
His fix is to keep a lasting record in the pull request or another accounting system. He listed which coding agent made the change. He also listed which session and person started it. He wants to know which commit each CI run confirmed. He wants a full test report, not just a status. Any skipped check needs a written reason. Approval should come from someone other than the person or bot that started the work.
Why it matters
Our reading: the risk here is quiet. Nothing breaks on the day a stamp is given. The problem appears later. An auditor asks what was verified, and nobody can say.
Korlam said sensitive industries should capture these decisions as rules or compliance checks. A firm that cannot show its checks cannot prove it did its job. Engineering leaders can ask one question now. If someone challenged this approval, what evidence would survive?
The other side
Korlam gave no figure for how often stamping happens. His claim rests on his view of the industry. He also works on Gitar, which he invited listeners to try. Readers should keep that interest in mind.
His remedy also leans on more automation. He suggested AI as the first stage of review. He also suggested automatic approval of low-risk internal changes. A record shows what was checked, not whether the checks were any good. He noted that a test could have been of poor quality. The talk leaves open how firms should judge the quality of automated review.
Written by the WebPulse Newsroom with AI assistance, and checked by our editorial review: every quotation was verified against the recording's transcript. How we use AI.
The conversation this talking point comes from
- AI Engineer: Rebuilding CI for AI-Scale Commit Volume — Gautam Korlam, SonarSource (2026-10-14)
