# CodeRabbit - How can you trust your AI agents? — LeadDev ## 🗂️ Triage — annotated highlights surfaced > [!note]- Cross Reference > - **Trust lives in the system, not the agent** — reframes agent trust as an infrastructure design problem (permissions, observability, audit trails), not a model-capability one. #xref > - **Stacked review bots cause rubber-stamping** — more automated review signal can reduce human oversight; the maker-should-not-grade-its-own-homework failure mode in code review. #xref ## 🧭 Bib capsule LeadDev (with CodeRabbit), "How can you trust your AI agents?" panel with Claire Reckless, Andrew, Priyanka, mod. Jenn Wiggins, 2026. https://www.youtube.com/watch?v=y_2vGKvhzaw ## 🧠 Author's thesis (Adler Q1+Q2) The panel's throughline is that trust in coding agents can't be verified once and banked — it's earned per session, because agents are probabilistic and past good behavior doesn't guarantee future good behavior. In detail: trust lives in the surrounding system (scoped "least agency" permissions, staged disclosure of the agent's plan/actions/reasoning, and exportable immutable audit artifacts), and the most urgent near-term risk isn't agent misbehavior but human reviewers losing the ability to review agent-generated code under rising volume — with a live poll finding 64% of attendees had lost track of what an agent was doing in the past week. ## 🧩 Key arguments - Trust is a property of the system (permissions, observability, checkpoints) the agent operates inside, not of the agent alone. - "Least privilege" becomes "least agency" for non-deterministic actors — fine-grained, shared, continuously-revisited sub-agent permissions. - Stacked review bots overwhelm reviewers into rubber-stamping; the fix is agents that explain themselves at the developer's level, plus per-session audit artifacts. If a workflow needs 100% trust, it should have been deterministic automation. ## 🗒️ Notes — Literature atoms ### Trust lives in the system, not the agent > [!quote] > "I think it's more about trusting the system that they're both operating within." - **Where**: Framing / Andrew on where trust rests - **Why**: Recasts "agent trust" as a systems/infrastructure design problem — directly useful for building or evaluating agentic tooling. ### Least privilege becomes least agency for agents > [!quote] > "the least privilege of traditional IM moves on to least agency" - **Where**: Audience question (Kieran), picked up by the panel - **Why**: A namable concept as agentic-security vocabulary matures — fine-grained, continuously-revisited sub-agent permissioning. ### Stacked review bots cause rubber-stamping > [!quote] > "I'm not reading through any of those. I'm rubber stamping it." - **Where**: Priyanka on reviewing PRs loaded with bot comments - **Why**: Names the core failure mode — more automated review signal can reduce, not increase, real human oversight. ## 🔖 Permanent candidates - 100%-trusted agent should be automation — If a workflow would need 100% trust to run unsupervised, that's a signal it should be deterministic automation, not an agent. [already_covered by "The Maker Should Not Grade Its Own Homework" / "Encoding What Good Looks Like Is What Makes Agent Verification Trustworthy" — same verify-don't-assume posture] ## Links - [[AI Agent Safety MOC]] — home MOC; least-agency permissioning, staged explainability, and per-session audit artifacts are agent-safety infrastructure - [[The Maker Should Not Grade Its Own Homework]] — the rubber-stamping failure mode is exactly this: automated review that stops functioning as an independent check - [[Encoding What Good Looks Like Is What Makes Agent Verification Trustworthy]] — the panel's fix (agents explaining themselves at a level a developer recognizes as "what I'd have written") is the encoding-what-good-looks-like move applied to code review - [[Stop Trusting AI; Start Verifying It with Ari Joury]] — Joury's verify-don't-trust architecture is the generalized form of CodeRabbit's staged, explainable review checks. - [[Meet the Community Agents - AI assistants for WordPress community workflows]] — both are human-in-the-loop deployments where nothing agent-generated ships without a person signing off. ## ✅ Processing checklist - [x] Claim atoms carried from deep-read analysis - [ ] Permanent candidates reviewed for promotion - [ ] Version History Diff check