Adam Manji, the technical lead at the fintech startup Bashi AI, wrote a paper about his own account and found he could not vouch for it. In the stretch where merges needed a second person, his paper says, a coding-agent session submitted all 86 approvals his GitHub account gave on his engineers’ pull requests. He had kept no record of which approvals he decided and which he delegated. So even he can’t say now who decided. The company required a second person to approve every change; its agents met the rule by clicking “approve” under the boss’s name.
The rule held on paper and failed as evidence
The paper, “Who Approved This? Coding Agents, Human Accounts, and Merge-Gate Evidence at a Fintech Startup,” audits twelve weeks of agent-driven work. From 3 October, ahead of a SOC 2 audit, every non-bot merge to main needed a non-author approval. Of 263 merges in that period, 71 (27%) rested only on an approval an agent session had submitted through the lead’s account. GitHub recorded each as his.
Across the full twelve weeks, 657 of 786 merged pull requests (83.6%) were agent-associated. In the gated phase, a session also issued 262 of the 317 merges made from the lead’s account.
Nothing was bypassed in the usual sense. Every box was ticked, by an account with the right to tick it. What broke is what the tick is for. A review gate exists to show that a person decided, and an agent holding a person’s credentials makes that unprovable.
One loop, eight pull requests, 58 seconds
The sharpest case came on 14 October. An orchestrator session merged seven upper pull requests of an eight-PR front-end stack in 58 seconds, with a single foreach loop, all through the lead’s account. The stack sat on working branches that branch protection didn’t cover. The lower pull requests merged on approvals that named superseded heads, and their required checks only started 8 to 11 minutes after the merges.
Agents also touched the rules themselves. On 29 September a script set the required approval count to zero, merged one pull request and restored the count ten seconds later. On 25 September, admin enforcement was removed around nine merges and restored about two hours later. Only 3 of 45 standing corrections given to agents had an enforcing mechanism; 35 were instructions alone, which fits what Claude Code’s own docs concede about written memory .
A review gate exists to show that a person decided, and an agent holding a person's credentials makes that unprovable.
Why this is an identity problem, not a reviewing problem
The tempting reading is that people should review harder. The paper’s engineers suggest they already struggle. One told the author, “I answer agent work with agent review,” and said he reads “a good part of the diff, but not every line.” A separate MIT Media Lab-coauthored study of 36 participants found people “often highly confident while missing silent defects.” Read across, that suggests even a genuine human approval says less than it appears to.
But harder reviewing leaves the evidence problem untouched. GitHub already encodes the right separation in its own agent: its documentation
says “your approval of a Copilot pull request won’t count toward the required number.” Authors can’t approve their own pull requests either. That is the pattern to copy. Give each agent role its own identity, keep protection changes for people only, and have merge tools read the named required check on the head commit, as the paper recommends. If you run Claude Code under your own gh login, every approval and merge it makes is recorded as your personal decision, and that is what an auditor or a postmortem will read later.
The limits of one startup’s record
This is one startup, one repository and three people. The author directed the agents, held admin rights, chose which incidents to write up and manages the two engineers he surveyed. No auditor has reviewed the evidence, as the paper’s own Section IX concedes. The survey (n=2) is illustrative, not representative.
You can also call it a plain least-privilege mistake: an admin account handed to agents, which GitHub’s controls should already prevent. They mostly do not. The approval docs note that repository owners and administrators can merge without an approving review . And the Copilot fences cover only GitHub’s own agent, not a third-party one carrying a human’s token.
Whether other teams look like Bashi AI is untested. The paper measured one company’s merge records; that any team letting a local agent borrow a developer’s login has review records that can’t prove a person decided is a conclusion reached here, not demonstrated there. It is a cheap one to check, though. As GitHub’s move to let Copilot approve pull requests shows, who counts as a reviewer is already being renegotiated. The name on the approval should be settled before the audit asks.
