Coding agents open more pull requests than people can read line by line. The goal isn't to read less — it's to spend human attention on the PRs that actually need it, and to make sure no agent can merge, or loosen the review rules, on its own.

If "good enough to merge" means "whatever the model thinks today", you get noisy line comments, and nothing stops an agent PR from quietly editing the instructions or workflow files it's reviewed with.

This walkthrough sets up AI pull request review where the repository holds the rules:

Deterministic rules put every PR in a lane: auto (low risk), review (a human must look) or block .

An AI model reads the diff and adds line comments, but can only make the lane stricter, never looser.

The rules and policy are read from the base branch, never from the PR branch.

I'll use MergeJudge , an AI pull request reviewer with an open-source (MIT) engine I built for this, as the example. Disclosure up front: it's my project.…