“So if it's a dependency bump and doc changes, we should be approving them. Any changes under sensitive stuff like payments or [auth] might need a human approver on top. And then of course you don't want to have the agent who made the change approve its change because that would not be uh zero trust.”
Video moment · 14:25 · youtube.com
From “Rebuilding CI for AI-Scale Commit Volume — Gautam Korlam, SonarSource”, found 2026-10-15.
To keep human review from becoming the queue, teams on Gitar write plain-English approval policies: low-risk changes are auto-approved and merged, sensitive paths escalate to a person. Each approval and override is recorded on the PR for audit, since CI logs expire. Quoted from YouTube’s auto-generated captions.