Human PRs get reviewed by someone who knows the codebase. Agent PRs often get merged by the same person who prompted them, five minutes later. That asymmetry is where the bugs live. Here is the checklist I run before merging anything an agent wrote.
#
Scope
- Every changed file is needed for the task. Anything else gets reverted, not explained.
- No renames or reformatting outside the task.
- No dependency upgrades as a side effect.
#
Correctness
- New behaviour has a test that fails without the change.
- Error paths return a real error, not a silent empty value.
- Removed or skipped tests are called out explicitly. This is the single most common cheat.
#
Money and data
-
Integer minor units, no floats, currency explicit.
-
Writes that can retry are idempotent and the key is visible in the diff.
-
Timestamps stored in UTC; no timezone-less date parsing.
#
Security
- No secret or key in plaintext.
- No user input reaching a query, shell, or HTML without escaping.
- No PII or secret in the new log lines.
#
Operability
- If it fails in production, a log line says why.
- It can be rolled back without a data migration, or the migration is stated.
The full version is fifteen checks; these are the ten that have caught real problems. If you only adopt one habit from this post, adopt the "removed tests must be called out" line — it catches the failure mode that quietly makes your suite useless.
I put this checklist plus the review command and a CLAUDE.md template in a free repo: AI Agent Engineering Kit — free starter.