Governing AI coding agents
A practical guide to keeping AI-generated code auditable and safe at scale — approvals, pull-request gates, blast radius, deployment gates, drift and budgets.
AI agents can generate more change than a team can safely review, integrate and remember. Governance is how you keep velocity without losing control. These are the controls Skaftor applies to every change.
1. Approvals in the workflow
Each step names who must approve before it moves on, and send-backs return work to a defined step. Even with "Run automatically" on, the approvals stay with people — and every decision lands in the audit trail on Activity.
2. Pull-request gates
A work order isn't done until CI is green and a clause judge has checked the diff against the acceptance criteria. Authors can't approve their own pull requests, and nothing merges unapproved.
3. Blast radius
Before merge, know what a change can affect. Skaftor computes blast radius from the dependency graph for every design section and work order, so review and testing scale to real reach rather than diff size.
4. Deployment gates and readiness
Deployment gates are app-specific rules generated from your code; enforced gates block a deploy, warn-only gates monitor. Insights grades each project's readiness, and the Deploy tab collects QA runs, PRD verification and evals before you ship.
5. Spec drift
Specs rot silently as code changes. The Drift Inbox flags shipped code that stops matching its spec, before it becomes an incident.
6. Spend controls
Budgets per work order, per QA run and per month — enforced at the model gateway — keep agent cost predictable.
Frequently asked questions
How is governance different from CI checks?
CI checks verify code mechanics (build, tests, lint). Skaftor's governance also enforces process and policy — role-based approvals, acceptance-criteria checks on the diff, deployment gates, QA sign-off and budgets — across the whole delivery lifecycle, not just the build.