Code Review Agent
Reviews pull requests for correctness, security and project conventions.
Reads every code change with the project's context in working memory (the diff, the surrounding code, the conventions, the security policy) and posts a precise, low-noise review. It reproduces suspect edge cases in a sandbox to confirm a bug is real before blocking; on security-sensitive paths a second judge agent re-derives the verdict before the merge commits.
Authority
Recommend for approval
Team role
Provides specialist analysis
Handoffs
Named collaborators
The role
What it owns and where its authority ends
Desk
Software Delivery & Code Review
Desk workflow
Ticket, then implementation, then review, then build checks, then merge and release, an agentic loop where the implementer agent and an independent review agent gate every change.
Collaboration
Calls several specialists in parallel
Decision boundary
An accountable reviewer commits the decision or action.
Systems and capabilities involved
Git / PR platform
read diff, post review comments
Test + reproduction sandbox
Static analysis / SAST
Secure-coding standards
Handoffs
What this role gives and receives
Capabilities offered
The handoffs name the next owner or specialist and the work that moves between them.
Handoff to
Receives from
External handoff
Cybersecurity (SOC) for confirmed code-level vulnerabilities
Context
What the role needs to do the work
- Current work
- The diff, the touched files, the project conventions and the review so far.
- Prior interactions
- Prior reviews on this repo and recurring issues the team makes.
- Policies and reference
- Language idioms, the bank's secure-coding standards, the style guide.
- Working method
- Review playbooks refined from which comments the judge agent upheld vs. overturned.
Illustrative workflow
How the work moves
Starting point
A code change touches the payment authorization service.
- 01
Pull the diff and surrounding code; load the secure-coding standard into context.
- 02
Run the test suite in the sandbox; reproduce a failing edge case the author missed.
- 03
Spot a missing duplicate-payment guard that could double-charge on retry.
- 04
Post a precise review with the failing test and a suggested fix.
Result
A blocking review on the double-charge bug with a reproduction and patch; routine style items batched as non-blocking. A second judge agent re-derives the verdict and the merge commits.
Checks and boundaries
What must be tested or reviewed
- 01Comment-acceptance rate tracked; low-signal nitpicking is penalized, not just missed bugs.
- 02Security findings cross-checked by an agent-as-judge before they block a merge.
- 03Cannot approve-and-merge alone on security-sensitive paths; a second judge agent must re-derive the verdict.
- 04All review runs traced and fed to AgentOps for drift detection.
Human authority
An accountable reviewer commits the decision or action.
Keep exploring