The article proposes a pattern language for code review in the age of agents. It starts from an observation: agents accelerate the volume of changes, senior engineers receive dozens of review requests per day, and exhaustive human review is no longer sustainable. Code review is defined as the examination of code by an entity that is not its author, resulting in a judgment followed by an action. The empirical studies cited show that its value lies as much in maintainability, the discovery of alternatives, and knowledge sharing as in bug detection; it would mainly be a risk-triage mechanism.
To take the human out of the critical path, three conditions are set. A maximum amount of validation must be shifted to deterministic checks, so that agents only handle the residual subjective space. Review must be graded by risk, from no human at all to explicit authorization. And every agent decision must leave a durable trace of what was evaluated, under which policies, with what confidence. Working without a human in the loop is a configuration choice justified by risk and evidence.
Toward a Pattern Language for Code Reviews in the Age of Agentic AI
Nine patterns make up the toolbox: small incremental changes, Shift Left, design for verification, deterministic engineering practices, context engineering, continuous quality loop, adversarial LLM review, multi-agent reviews, specification-driven development. The continuous loop has an author agent and a reviewer agent exchange until a convergence criterion is met. Adversarial review provides structural independence, through a different model or an isolated session. Multi-agent reviews split the work among specialists, a triage agent, and a coordinator. Context engineering conditions the rest: without it, findings are noisy.
Three cases illustrate this. Block, faced with agent PRs left unreviewed, moved from noisy in-house reviewers to commercial tools, stacked PRs, local adversarial review, and automatic correction in CI. Cloudflare built a CI-based orchestration around OpenCode: specialized reviewers, a coordinator, graded review, filtering of noisy files, a human bypass, and carrying findings forward from one commit to the next. Over one month, 131,246 reviews cover 48,095 PRs across 5,169 repositories, with an average of 1.2 findings per review. DryRun Security turned a tenant-isolation flaw into a policy verified on every change.
In conclusion, the authors present the transition as a reorganization of responsibilities: precise specifications, independent verification, durable audit trails. The guiding question: if something went wrong, how would anyone know?