When agents merge their own code, the review moves into the guardrails

Lauren Tan helped build and deploy Grok Bot. On Y Combinator's Lightcone show, she said she now lets her agents merge their own pull requests. A pull request is a proposed code change that waits for approval. Her point was that human review has not gone away. It has moved into the automated checks around the code.

What was said

Tan said the team took a while to get there. It needed good guardrails. She said the time spent on human code review "is encoded into your code base and your static analysis and your tooling". Static analysis means programs that inspect code for faults without running it.

The result, in her words: "I've gotten to a point where I essentially have my agents merge their own pull requests." In one case she did not read the change at all. The team judged the work by what it produced.

A speaker on the show gave a concrete rule. The Grok Bot desktop app uses Electron, and its display thread stutters when given long tasks. The team did not want to rely on reviewers spotting that. In the speaker's words: "We don't want to have to catch it in code review."

So they wrote a lint rule and a dependency graph checker. It forbids importing between the main thread and the render thread. The speaker said continuous integration (CI) enforces it. CI means the automatic checks run on every change. The change cannot even be checked in. The speaker also said this saves tokens they no longer have to spend. Tokens are the units AI usage is billed in.

Why it matters

Our reading: the review was written once, in advance, by a person. If nobody wrote a rule for a risk, no step looks for it. A manager who asks who approved a change may now need to ask who wrote the checks. They may also need to ask who audits them.

That moves the skill from reading each change to deciding what to forbid. The people who write those rules carry risk that reviewers once shared. Buyers and engineering leaders can ask where a team's guardrails live and who owns them.

The other side

Tan said it is hard to get there overnight. A speaker added that people may still want to stay in the loop for critical areas. The examples were infrastructure, databases and deployment. The team also still does some human review from time to time.

The example rule is narrow. It blocks one kind of import between two parts of an app. It does not measure how long a task takes, as the speakers themselves noted. A check catches only what someone already thought of.

One speaker also said they work at a lab with unlimited tokens. That is an unusual position from which to judge cost. The conversation did not say who answers when a missing rule lets a fault through.