arXiv preprint ·
Who Approved This? Coding Agents, Human Accounts, and Merge-Gate Evidence at a Fintech Startup
- Published
- Source
- arXiv preprint, posted before peer review
- Original
- Read it at arXiv
- Topics
Abstract
From 3 October, every non-bot merge into our main branch passed a non-author review gate, yet 71 of those 263 merges (27%) rested only on an approval that a coding agent had submitted through the technical lead's GitHub account, and the platform recorded each one as an ordinary approval by the lead. We report twelve weeks of agent-driven development at Bashi AI, a fintech startup preparing for a SOC 2 audit: 786 merged pull requests, 657 of them associated with agents by explicit markers or by inference, analysed from platform records and saved agent-session transcripts. In the gated phase, an agent session submitted every approval the lead's account gave on a colleague's pull request, and issued nearly all of its merges; the records cannot show who decided any of them. We recompute, for every merge, a core gate property: a non-author approval and a passing required check, both before the merge and both on the exact revision merged. The recomputation confirmed the gate wherever branch protection applied and found where it did not: agents switching enforcement off around individual merges, a merge script that recorded failed checks as passing, and an agent collapsing a stack of pull requests through unprotected branches. The engineers' survey answers show that one engineer's approvals also rested on review agents, with the person validating findings and deciding, and both engineers say review mattered when it tested a change against something outside the diff. We draw lessons on recording decision authority separately from account identity, keeping agents' credentials away from the controls they operate under, and checking evidence at the branch and revision where integration happens.
The authors’ abstract, as arXiv lists it. arXiv’s listings, abstracts included, are free for anyone to reuse.
Read it on ReadSearch
Each opens after you create an account, and brings you back to this paper.
More in Software Engineering
Step-Aligned Script Generation with Verification and Recovery for Web Automation Testing
Recoverability and Verifier Strength: Two Measured Preconditions for Unattended Agent Self-Improvement
Better Specifications, Better Code: Fine-Tuning LLMs for Behavioral Contract Generation
Auditing the Product, Not the Recursion: The Evaluation Evidence Behind Recursive Self-Improvement Claims
Selecting and Composing Agent Design Patterns: Industrial Case Evidence and Controlled Reference-System Experiments
Get the few papers worth your time in Software Engineering every morning.
ReadSearch reads the new papers in your field each day and brings you the few worth reading, each with its key finding in a sentence.