Knob

Merge policy

You might say: merge authority, agent may merge, auto-merge policy, risk tolerance

The risk classes an agent may merge on its own once the required checks and evidence pass. The rest wait for a person. A short "always human" list names areas such as auth, payments and migrations that always need a human approval, and a change to the gates themselves always goes to a human.

What it does

Takes low-risk work out of the human review queue while keeping a person on the changes that need judgement.

Ask

Which risk classes may merge without a human today, which areas always need one, and what evidence would widen the policy?

Typical

Start at none, with a person merging everything. Widen to low risk, then to low and medium, as the evidence holds.

Trouble

The policy widens on hope, or an agent edits the gates that decide what it may merge.

What to look for

1. A checked-in "agent may merge" setting beside an "always human" list
2. Auto-merge enabled on a pull request, waiting for required checks
3. High-risk or gate-changing pull requests parked for a person

Catalogue: Agent may merge

• None: A person merges every pull request, whatever its risk class. A factory starts here.
• Low risk: Agents merge low-risk pull requests once the checks are green. Medium and high risk wait for a person.
• Low and medium: Agents merge low- and medium-risk pull requests once the checks, an AI review and the run's own proof pass. High risk waits for a person.

Pattern

Two-way door

Connections

• Controls: Human review
• Lowers: Review queue

Sources

1. Kent C. Dodds, kcd-skills, autopilot skillonly low/medium risk with green CI auto-merges.
2. Kent C. Dodds, kcd-skills, autopilot skillName the changes that always need your approval (e.g. auth, payments, migrations, public API, store releases)
3. Kent C. Dodds, kcd-skills, autopilot skillthe human always merges it (it changes the gates).
4. Kent C. Dodds, kcd-skills, autopilot skill, references/templates.mdHigh risk, red or pending CI, and anything in Always human park for the human.
5. GitHub, Automatically merging a pull request, Automatically merging a pull requestAuto-merge merges a pull request automatically after all required reviews and status checks pass
6. Lauren Tan, Noodle, docs/concepts/modes.mdThe mode is a trust dial, not a capability switch.
7. Mohannad Hammadeh et al. (AWS), Scaling agentic coding past the human bottleneck, Scaling agentic coding past the human bottleneckA low-risk ticket went the whole way on its own, code read, fix written, pull request raised and merged, ticket updated, with nobody touching a keyboard.

Use it on your project

teardown-apply: hold "Merge policy" (merge-policy) from the teardown at https://teardownatlas.com/software-factory/ against my project

Paste it into a coding agent that has the teardown skills.

An AI agent wrote this map with the teardown skill. It can contain errors: check the sources before you rely on a part. About and legal