Coding Agent Change Governance

Software teams using Claude Code should add AI-authorship fields to pull requests and connect them to review rules. A useful first version is simple: require the author to mark whether a coding agent wrote or edited the change, store the agent session link or prompt summary, and trigger extra review for security-sensitive files, deployment scripts, infrastructure-as-code, and model-facing services.

The pressure comes from adoption speed. Anthropic says more than four-fifths of the code it published in May was written by Claude, after a low-single-digit share before Claude Code launched in February 2025. At that level, AI-authored code is ordinary production input. Review systems need provenance, ownership, and rollback context on the diff itself, because the reviewer may be checking code produced through a toolchain they did not directly operate.

AI labs and infrastructure teams should keep a separate change record when a coding agent edits evaluation harnesses, release automation, monitoring, CI configuration, or developer tools used by other engineers. The record should capture the repository area, reviewer, test evidence, deployment impact, and whether the change affects tools used to assess or ship later AI systems.

This is a narrow governance layer for a concrete feedback loop: a coding agent can help build the software used by human developers, and some of that software may support future AI development or supervision. The cheap test is to run the record on one month of changes in repos that contain evals, CI, and internal developer tooling, then check whether reviewers can answer who or what generated each change and which downstream systems rely on it.