Skip to lesson
Exit
CI/CD, release engineering & the toolchain1 / 2

2 min lesson

A deterministic gate pattern: risk-rate the PR, route the review

Take "A deterministic gate pattern: risk-rate the PR, route the review" step by step, then finish with the result that proves it worked.

Step 1 of 2

A deterministic gate pattern: risk-rate the PR, route the reviewwhere attribution becomes dispatch

Attribution isn't only for auditors after the fact - it powers a live gate pattern that drains the review queue without weakening SoDSeparation of Duties. Short for separation of duties: the rule that authoring, approving and deploying a change never sit with one person. Auditors use the acronym; the control is the same. Press Enter for the full definition.. An automation triggered on PR-opened classifies the change as low / medium / high risk and routes accordingly:

  1. 1Low-risk (e.g. a title or copy change): auto-approved so it merges without burning a human reviewer's attention.
  2. 2High-risk: held for human review, with the right reviewers assigned automatically - the automation runs git blame on the touched lines to find the people who actually own that code.
  3. 3The human who clicks merge is still accountable; the automation only routes attention, it never promotes the change itself.
The governance guarantee buyers want to hear

No automation agent ever merges directly. It always produces a human-reviewed PR and the person clicking merge is the accountable party - that's how SoDSeparation of Duties. Short for separation of duties: the rule that authoring, approving and deploying a change never sit with one person. Auditors use the acronym; the control is the same. Press Enter for the full definition. survives contact with automation. The security model barely changes; the one genuinely new attack vector is who can trigger the automation (don't wire people who shouldn't touch your code to a code-touching automation). Scope every tool to least privilege - a read-only SQL/Databricks connection so an agent can fetch but never drop a prod table - and the controls owner relaxes.

Watch out

Never describe auto-approval as 'the AI approving its own code.' That's a self-approval / SoDSeparation of Duties. Short for separation of duties: the rule that authoring, approving and deploying a change never sit with one person. Auditors use the acronym; the control is the same. Press Enter for the full definition. violation the moment a controls owner hears it. The correct frame: low-risk changes skip human review by deterministic policy you configured; the AI is never the accountable approver on anything that matters, and high-risk work is routed to the right humans, not around them.