Skip to lesson
Exit
CI/CD, release engineering & the toolchain1 / 2

2 min lesson

A policy-bound gate pattern: risk-rate the PR, route the review

Rebuild the sequence in "A policy-bound gate pattern: risk-rate the PR, route the review" from memory, ending with the check that proves the outcome.

Step 1 of 2

A policy-bound gate pattern: risk-rate the PR, route the reviewwhere attribution becomes dispatch

Cursor's PR Routing & Approval agents run on PR events, score each PR's risk and either approve it under a maximum risk threshold you set or assign reviewers. Attribution isn't only for auditors after the fact. The same signals drain the review queue without weakening SoDSeparation of Duties. Short for separation of duties: the rule that authoring, approving and deploying a change never sit with one person. Auditors use the acronym; the control is the same. Press Enter for the full definition.:

  1. 1Low-risk, such as a title or copy change: approved under your threshold so it merges without burning a human reviewer's attention.
  2. 2High-risk: held for human review and routed to reviewers per your routing guidance and APPROVAL_POLICY.md files, for example guidance to route to the code's recent authors.
  3. 3If BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. or Security Agents report findings that need human review, the agent will not approve.
  4. 4The human who clicks merge is still accountable. The agent only routes attention and approval; it never promotes the change itself.
The governance guarantee buyers want to hear

No automation agent ever merges directly. It always produces a human-reviewed PR and the person clicking merge is the accountable party. That's how SoDSeparation of Duties. Short for separation of duties: the rule that authoring, approving and deploying a change never sit with one person. Auditors use the acronym; the control is the same. Press Enter for the full definition. survives contact with automation. The security model barely changes; the one genuinely new attack vector is who can trigger the automation, so don't wire people who shouldn't touch your code to a code-touching automation. Scope every tool to least privilege, such as a read-only SQL/Databricks connection so an agent can fetch but never drop a prod table, and the controls owner relaxes.

Watch out

Never describe auto-approval as 'the AI approving its own code.' That's a self-approval / SoDSeparation of Duties. Short for separation of duties: the rule that authoring, approving and deploying a change never sit with one person. Auditors use the acronym; the control is the same. Press Enter for the full definition. violation the moment a controls owner hears it. The correct frame: low-risk changes skip human review under a risk threshold and approval policy you configured; the AI is never the accountable approver on anything that matters, and high-risk work is routed to the right humans, not around them.