Rootly abandoned its long-standing small pull request rule after discovering that agentic AI code generators think in complete features rather than isolated increments.
The Economics of AI Code Generation
Software engineering workflows are undergoing a structural reset as automated tools rewrite the cost and mechanics of writing code. For two years, incident management platform provider Rootly enforced a strict small-pull-request culture. The strategy relied on stacked pull requests and atomic changes limited to a few hundred lines of code. This practice made operational sense when humans wrote every line by hand, because smaller diffs proved easier to review, test, and revert.
That operational calculus broke down once AI agents began generating the bulk of the company’s codebases. An agent produces comprehensive implementations in a single output, bundling database migrations, underlying models, backend services, API controllers, automated tests, and frontend components together.
Forcing artificial intelligence models to break these outputs into stacked pull requests generated technically correct code that was contextually worse. Reviewers found themselves bogged down in mental gymnastics across multiple browser tabs, trying to track dependencies scattered across artificial divisions. The small-pull-request rule had been optimized exclusively for human writing speed. When automation removed that bottleneck, the rule transformed into pure organizational overhead.
Shifting the Safety Boundary to Blast Radius
Rather than reviewing AI-generated code through the traditional lens of line counts, engineering teams are learning to evaluate the potential scope of failure. As Rootly’s engineering team observed, artificial intelligence bugs are fundamentally context bugs where code functions perfectly in isolation but collides with the broader system. An agent might write a valid database migration that drops a column still actively used by an unmigrated background job, or build a service that writes to a shared table read by another team.
To combat this, the organization built an internal AI code reviewer designed to scan every pull request against strict engineering standards. Instead of acting as a human replacement, the automated tool answers a single targeted question: if the change introduces a bug, what specific user-facing behavior breaks? The reviewer categorizes modifications by risk profile, giving human reviewers a structured starting point.
Safety boundaries have consequently shifted from the moment of code merge to the progressive rollout phase. Major features now ship behind feature flags, allowing teams to push code to production while keeping it disabled. The real evaluation occurs during progressive deployment, moving systematically from the internal team to a handful of test customers, expanding to 10 percent of users, and finally achieving general availability.
Industry Alignment on Agent-Speed Workflows
The move away from traditional pull request economics is drawing broader industry consensus. At QCon London 2026, Michael Webster delivered a presentation on headless AI agents and their disruptive impact on software delivery pipelines, noting that massive AI-generated pull requests create severe bottlenecks for human reviewers while accumulating persistent technical debt.
Other technology companies are adopting similar risk-based paradigms. Backup and versioning provider Rewind adopted a risk-focused model for its internal tool, Diff Vader. According to insights shared on the Rewind blog, a pull request’s risk level has virtually nothing to do with its physical line count.
During a panel discussion at AI Native DevCon London in June 2026, industry figures including Patrick Debois argued that pull request workflows function effectively in open-source environments where trust must be earned among unaligned contributors. Within tightly aligned internal teams, however, the overhead of a traditional review cycle becomes difficult to justify when automated agents operate at high velocity.
Parallel Benchmarks for Automated Security
While software delivery pipelines adapt to agent speeds, parallel efforts are underway to benchmark how artificial intelligence models handle complex analytical tasks in cybersecurity. Microsoft introduced an open-source evaluation framework named CTI-REALM to test AI agents on end-to-end detection engineering, moving beyond basic trivia recall into practical operationalization.
The benchmark evaluates whether an agent can translate narrative threat intelligence reports into validated Sigma rules and Kusto query language logic. Tested across Linux endpoints, Azure Kubernetes Service, and Azure cloud environments, the framework assesses intermediate analytical decisions rather than just final outputs. According to Microsoft Security, evaluating configurations on CTI-REALM-50 demonstrated that frontier models—specifically early previews of Anthropic’s Claude—achieved strong performance driven by superior tool-use and iterative query behavior.
Capturing Context Beyond Automation
As engineering organizations dismantle legacy review constraints, capturing human intent remains a vital engineering safeguard. Rootly now mandates that human authors fill out explicit motivation and impact sections for every pull request, outlining the business reason for a change and providing instructions for safely undoing it if necessary. Artificial intelligence assistants are explicitly instructed not to generate these sections.
The strategy underscores a central tension in modern software development. While automated tools accelerate raw code generation, the responsibility for maintaining system context, defining blast radiuses, and preserving architectural safety rests entirely with the humans prompting the agents.
Worth a look
