Automate code review with AI by giving the reviewer a defined trigger, trusted repository context, objective checks, and a clear boundary around human approval. The AI should prioritize actionable risks and evidence, not produce a large volume of stylistic comments.
Run deterministic checks first: formatting, linting, types, tests, dependency policy, and security scanners. Then provide the AI with the change description, diff, affected contracts, project rules, and check results. Ask it to look for behavior regressions, unsafe data flows, missing authorization, migration risk, concurrency problems, and tests that do not prove the claimed behavior. Make every finding cite a file and tight line range, explain the failure scenario, and distinguish a blocker from a suggestion. Suppress repeated or low-confidence comments, and update the review when the diff changes.
Keep merge authority with designated humans, especially for security, billing, identity, data deletion, and production configuration. Track true findings, false positives, missed defects, review time, and author response. Those metrics reveal whether automation improves review or merely moves attention to comment triage.
Pilot the workflow on one repository and a limited set of change types. Tune rules from accepted findings, not from comment count. A useful AI reviewer makes the important risks easier to see while leaving the final engineering decision explicit and accountable.
