ON THIS PAGE (14 SECTIONS)
- ✓Never trust author identity alone: human and agent diffs must undergo the exact same deterministic gates.
- ✓AI assistants excel at drafting implementations but introduce distinct failure modes: hallucinated packages and tautological tests.
- ✓High-risk pathways (auth, ledger, schema migrations) must enforce named human approvals via CODEOWNERS.
- ✓A pull request cannot merge if no human engineer on the team can explain the runtime mechanics of the diff.
Modern AI coding assistants and autonomous agent workflows make it remarkably cheap to produce software pull requests. In minutes, an agent can refactor entire directories, generate scaffolding, and produce hundreds of lines of code. However, generating diffs quickly is not the same as ensuring they are safe to run in a multi-tenant production environment.
Relying on 'the model said LGTM' is not a merge policy. Neither is a green unit test suite that never actually exercises the edge cases or blast radius of the system. This checklist codifies how AI-assisted pull requests must be reviewed before they are permitted to merge into production repositories at Vasiva.
Who This Checklist Is For
- Engineering Managers establishing team policies for Copilot, Cursor, Claude Code, and agentic PR bots.
- Staff and Principal Engineers responsible for code quality, architectural integrity, and production stability.
- Platform and SRE Teams configuring CI/CD pipelines that evaluate code based on deterministic verification rather than author provenance.
Pre-Merge Verification Checklist: The 8 Core Dimensions
We treat this checklist as a standard section in pull request templates. Every dimension is mandatory before a merge button is unlocked:
1. Intent and Blast Radius
- Explicit Problem Statement: The pull request clearly articulates what user or system behavior changes.
- Scoped File Touches: The files modified strictly correspond to the declared problem. Unrelated 'drive-by refactors' generated by AI agents must be rejected.
- Explicit Blast Radius: The PR description names all affected microservices, databases, background queues, and feature flags.
- Verified Rollback Path: An immediate recovery strategy is documented (feature flag disable, safe Git revert, or database rollback script).
2. Secrets, Credentials, and Environment Safety
- Zero Secret Ingestion: Automated entropy scans and manual inspection confirm no API keys, private keys, or tokens exist in the diff.
- No Credential Exposure in Fixtures: Test mocks and local seeds do not contain real user data or semi-private staging URLs.
- Environment Variable Hygiene: All newly introduced environment variables are documented in sample config files with secure default values.
3. Dependency and Supply Chain Integrity
One of the most dangerous failure modes of generative coding agents is 'package hallucination' — inventing plausible-sounding library names that attackers can register with malicious payloads on npm or PyPI.
- Lockfile Diff Scrutiny: Every addition in package-lock.json or poetry.lock is explicitly reviewed and verified against authoritative upstream repos.
- Justified Dependencies: New packages are only accepted if standard library or existing framework utilities cannot accomplish the task.
- Automated Vulnerability Scan: CI automated vulnerability checks (e.g., npm audit or Snyk) pass with zero critical or high advisories.
4. Behavioral Tests That Match Real Risk
AI models frequently write tautological tests — tests that mock out the core logic so thoroughly that they will pass even if the implementation is completely broken.
- Negative Regression Validation: Tests genuinely fail when the bug is reintroduced or when core assertions are inverted.
- Permission & Tenancy Tests: Every change modifying database queries or authentication handlers includes explicit cross-tenant isolation tests.
- Human Validation of Generated Tests: A human engineer inspects generated test assertions to confirm they validate domain business rules rather than mocking trivialities.
5. Prompt and Tool Surfaces in Agentic Coding
- Strict Tool Allow-Lists: When agents are granted MCP tools or API invocation capabilities, all available tools must be explicitly allow-listed.
- Least Privilege Execution: No broad filesystem write permissions, arbitrary bash execution, or production database credentials granted to agent runtimes.
- Prompt Injection Defense: Systems ingesting untrusted external text into LLM prompts have strict schema separation between instructions and payload data.
- Mandatory Approval on Mutating Actions: Irreversible actions (financial debits, account terminations, schema migrations) must require explicit human confirmation.
6. Deterministic CI Gates: The Non-Negotiable Floor
Automated CI checks represent the immutable baseline of software health. No PR author — whether human or AI agent — can bypass these status checks:
- Strict TypeScript / Typecheck verification with no newly introduced 'any' bypasses.
- Linter checks with zero warnings or suppressed rules.
- Integration and unit test suites running clean in an isolated container environment.
- Static security analysis (Semgrep, SonarQube) targeting high-risk patterns in the diff.
7. Mandatory Human Judgment Gates
A designated senior engineer must explicitly approve the pull request when any of the following critical conditions are met:
| Condition Trigger | Failure Mode / Risk Rationale | Required Action |
| Authentication, ACL, or Tenancy modified | Cross-tenant security breach or privilege escalation | Manual review by Security / Backend Lead |
| Financial ledgers, payments, or PII touched | Data corruption, financial inaccuracy, or regulatory breach | Two named human engineering approvals |
| Public API contracts or database schemas changed | Breaking backward compatibility or data migration failure | API steward review and migration verification |
| Agent tool access expanded | Unchecked blast radius or command injection | Platform engineer inspection of tool boundaries |
| Reviewer cannot explain the diff | Comprehension failure and unmaintainable code accumulation | Immediate rejection until simplified or decomposed |
If nobody on the engineering team can clearly explain the runtime behavior of a diff, it does not merge — regardless of how clean the AI-written summary sounds.
8. Documentation and Operability
- Runbooks & Architecture Docs: Updated whenever system behavior, network topology, or operational procedures change.
- Feature Flags: Feature flag keys, expected default states, and expiration dates documented in the PR.
- Observability & Telemetry: Appropriate metric counters, structured logs, and alert thresholds wired for newly introduced failure modes.
Anti-Patterns in AI-Assisted Engineering
Across our audits of engineering organizations adopting AI coding tools, we repeatedly observe these recurring anti-patterns:
| Anti-Pattern | Operational Hazard | Standard Engineering Remedy |
| 'The AI wrote it, ship it' | Silent regressions and unmonitored security flaws | Enforce strict CI gates and human verification for all high-risk paths. |
| Rubber-stamping massive 2,000-line diffs | Accumulation of technical debt and unreviewed hallucinations | Mandate small, incremental pull requests; reject oversized drive-bys. |
| Disabling flaky tests to turn CI green | Erosion of test integrity and blind production deployments | Fix root-cause test failures or reduce the PR scope. |
| Granting agents temporary production admin rights | Unmitigated blast radius and catastrophic data loss | Enforce scoped API tokens, time-boxed break-glass procedures, and complete audit logging. |
| Marketing 'Fully Autonomous Engineering' | Misleading executive teams and masking severe operational risks | Adopt an honest, verifiable framework: AI assists drafting; engineers gate execution. |
How This Fits Vasiva Delivery
Vasiva builds Enterprise AI and Product Engineering systems for organizations globally from Coimbatore, delivering through rigorous remote engineering protocols. The same review philosophy applies directly to our sequential product work (WorkHub, AimHabits, TalkBetter, and Dima) as it does to enterprise engagements: engineering velocity without deterministic verification is a liability.
What We Refuse to Claim
In accordance with our engineering truth policy, we refuse to make unsubstantiated claims:
- No claims that AI replaces senior software engineers or architectural oversight.
- No fabricated auto-merge percentages or synthetic developer productivity statistics without auditable instrumentation.
- No vendor bake-off rankings invented for marketing or search engine manipulation.
References & Prior Art
OWASP Top 10 for Large Language Model Applications (v2.0)
OWASP GenAI Security Project • OWASP Foundation (2025)
Software Engineering at Google: Code Review Best Practices
Titus Winters, Tom Manshreck, Hyrum Wright • O’Reilly Media / Abseil Open Source (2020)
Secure Software Development Framework (SSDF) Version 1.1
Murugiah Souppaya, Karen Scarfone • NIST (National Institute of Standards and Technology) (2022)
Vishal
Founder & Engineering LeadVishal oversees architecture and reviews AI-assisted code in production systems at Vasiva, establishing merge gates where human engineering judgment must govern the release path.
