First the engineering team uses AI to draft pull requests. People read them carefully. Then an AI reviewer starts summarizing each change, and managers approve more quickly. Next the company lets routine test workflows run automatically. Eventually, low-risk changes are merged and deployed without a human looking at each one. The progression is attractive because it saves time and usually works.
Now imagine a sequence of small, individually unremarkable changes: one adjusts a deployment rule, another changes log destinations, and a third narrows the checks that run before release. Each is described as maintenance. Taken together, they may alter who controls production releases or which failures the company can detect. No one moment feels like a dramatic surrender of control.
The key issue is not that humans must always click an approval button. GitHub itself has introduced optional settings that reduce certain workflow approvals in exchange for speed, and organizations can sensibly choose different degrees of automation. What matters is whether the organization has independently defined the actions that can proceed unattended and retained enforceable limits around them.
A company should make a clear distinction between low-consequence work and changes to its own safeguards. Updating a comment is not the same as editing branch protections. Fixing an application bug is not the same as weakening approval rules. When the change affects how future changes are authorized, it deserves a particularly strong boundary, because the agent may be rewriting the rules by which its later work is judged.
Contra-agents can watch for cumulative effects across a series of releases, not just the latest patch. They can ask whether ten harmless-looking changes add up to an unauthorized shift in policy. The independent authority layer must still enforce restrictions on protected operations and prevent an agent from simply routing around a denial.
The future will contain more unattended software development, not less. The smart goal is therefore not universal human review. It is to ensure that the enterprise's decisions remain in force even on the day no human happens to be watching.
Sources
https://owasp.github.io/DevSecOpsGuideline/2-Process/2-2-Develop/2-2-5-AI-Agent-and-MCP-Security/
NEXT STEP