---
title: "The Bottleneck Moved to Review — and Nobody Agrees on What Happens Next"
url: https://tiarebalbi.com/en/blog/review-bottleneck-unbundling-code-review
markdown: https://tiarebalbi.com/en/blog/review-bottleneck-unbundling-code-review.md
description: "Code review was the profession's control point: observation, decision, enforcement in one place. Agents broke its arithmetic. What each relocation gives up."
author: "Tiarê Balbi Bonamini"
locale: en
published: 2026-09-21
updated: 2026-09-21
category: "AI"
tags: ["ai-development", "code-review", "engineering-practices", "agents", "essay", "perspective"]
---
# The Bottleneck Moved to Review — and Nobody Agrees on What Happens Next

Code review was never just about finding bugs. For twenty years it was the profession's **control point**: the one place where observation, judgment, and enforcement happened to coincide — a human who could see a change, decide whether it belonged, and stop it with a button. AI did not eliminate that control point. It overloaded it.

The [previous post in this series](https://www.tiarebalbi.com/en/blog/spectator-trap-staying-in-control-ai-development) ended with a rule I hold myself to: no accept-all, ever — every merged diff gets read. The sharpest objection I have heard since is one every experienced engineer will recognize as an arithmetic argument, not a lazy one: _that does not scale._ Agents generate code faster than any human reads it. A discipline that requires reading everything is a discipline with a built-in expiration date. Measurement confirms the strain: Faros AI's [2026 Engineering Report](https://www.faros.ai/blog/ai-acceleration-whiplash-takeaways), drawn from telemetry across 22,000 developers, found median review duration up 441.5% — and, more quietly alarming, pull requests merged with zero review up 31.3%.

The industry's responses — let agents review the agents, replace review with verification, ration human attention by risk — are usually debated as workflow choices. They are not. Each one is a proposal about where to move the control point, and each relocation quietly gives up something the original point provided. That trade is the subject of this post.

## What a control point actually is

A control point is not wherever a process happens to pause. It is the place where three things coincide: **observation** (you can see what is passing through), **decision** (you can judge it against intent), and **enforcement** (you can stop it). Remove any one of the three and control becomes theater — a dashboard you can't act on, a gate you can't see through, an opinion nobody has to obey.

Before the theory stacks up, make it concrete. Agent A generates a 700-line PR overnight. Agent B — a review agent — reads it, leaves two comments, approves. A human merges it at 8:30 the next morning, between standup and the first meeting. Every part of the ritual happened: something observed the change, something judged it, someone enforced the merge. Now ask where the control point was. Observation lived in Agent B. Decision lived in Agent B. Enforcement lived in a human who never read the diff. All three functions executed — they just never coincided in anyone. And the only party in that chain who can be paged at 3 a.m. is the one who saw the least. That is not a control point. That is its silhouette.

Pre-merge review earned its old position because a single act — one human reading one diff with a merge button in hand — delivered all three functions at once. And because it did, it quietly controlled five different things at the same time: defects, intent conformance, knowledge transfer, accountability, and architectural coherence. One checkpoint, five kinds of control — which is precisely why it felt so load-bearing and why nobody itemized what it carried.

A control point that functions has to satisfy harder requirements than most discussions admit, and naming them is what makes the current situation legible.

It must **match the rate of the flow it governs**. This is the requirement the agent era broke, and Amdahl's law says why cleanly: generation parallelizes — five agents, five diffs — while judgment does not. One person's comprehension is a single-threaded resource with a fixed clock speed. A pipeline of parallel generators feeding a serial judge converges on the judge's throughput no matter how many generators you add; the fleet does not make you faster, it makes the queue in front of the control point longer. I wrote about this shape in [backlog arithmetic](https://www.tiarebalbi.com/en/blog/queue-wont-drain-backlog-recovery-math): a consumer sized for steady state has zero recovery capacity. The reviewer is now that consumer.

It must be **independent of what it controls**. A checkpoint that shares failure modes with the thing it checks is a correlated observer, not a control. This is the requirement most at risk in the tooling wave, and I will come back to it.

Its failures must be **attributable**. Control implies someone answerable when the gate passes what it should have caught. A control point nobody owns is a filter, not a control.

And it must sit **where intervention is still cheap**. Position is leverage: the same defect costs a sentence at brief time, a paragraph at spec time, a review comment at merge time, and an incident bridge at 3 a.m. Control points migrate upstream in mature systems for exactly this reason — the earlier the point, the denser the information and the cheaper the correction.

One more property matters, and it is the one the Faros data catches in the act: **a saturated control point does not degrade gracefully — it gets bypassed.** Any network engineer knows what traffic does when a checkpoint can't keep up: it routes around. That is what "zero-review merges up 31.3%" is. Not a policy anyone wrote down; the flow finding the path around a checkpoint that stopped rate-matching. This is the most dangerous state a control point can be in — still present on the org chart, still named in the process doc, no longer controlling anything. The real risk of the review bottleneck was never slowness. It is that the control point turns _nominal_ while everyone still believes it exists.

Hold those requirements — rate-matching, independence, attributability, position, and the bypass behavior under saturation — and the industry's three answers stop being a style debate. Each is a relocation of the control point, and each one sacrifices a different requirement to restore rate-matching.

## Three relocations, three different sacrifices

**Relocation one: downstream, into another agent.** GitHub's Copilot review passed sixty million reviews, a tenfold jump in under a year — a number Addy Osmani highlights in his [Agentic Code Review essay](https://addyosmani.com/blog/agentic-code-review/). Machine-speed review of machine-speed code restores rate-matching perfectly. What it gives up is independence and attribution. The reviewer is the same class of system that wrote the code, trained on the same distributions, blind in correlated ways — an observer that shares the failure modes of the observed, which is the one thing an observer must not do. And it cannot be paged, so accountability quietly transfers to whoever clicks merge — who, the data says, is increasingly the same person who briefed the agent. The 8:30 morning above is this relocation, and it is not an anecdote: an MSR 2026 study of [40,214 pull requests](https://arxiv.org/abs/2601.18749) found 77.5% of merged agentic PRs were merged by their own submitter, against 57.6% for human PRs. Trace the control loop there: one person briefs, an AI writes, a correlated AI approves, the same person merges. Observation, decision, and enforcement never leave a loop of one — the control point did not relocate so much as collapse inward.

**Relocation two: upstream, into the spec and the tests.** The verify-don't-review camp is the most intellectually serious one: build verification systems — tests the agent must satisfy, conformance suites, sandboxed rollouts — and let it iterate until the software demonstrably works. Paul Dix [makes the maximalist case](https://pauldix.com/the-end-of-programming): given verification and direction, an agent can "continue to refine it until it just works." As a relocation this is coherent: enforcement becomes automatic and machine-speed, and decision moves upstream to specification time — the position with the most leverage, exactly where control theory says it should go.

What it gives up is the _width of observation_. The old control point observed what a change actually did, as judged by a person who knew what it was supposed to do. The new one observes only what the spec expresses. Verification is a property of an artifact — does this code meet this specification — and it is checkable at machine speed. But whether the specification captures the intent is a property no artifact carries, and nothing in the loop checks it: the tests prove the code does what the tests say; nobody proves the tests say what you meant. Control over intent did not disappear — it moved to whoever writes the spec, usually the person who spent the least contested time thinking about the problem. And a second thing leaks out entirely: the organization's comprehension. A pure verify-don't-review pipeline produces verified artifacts and a team that understands none of them — a debt invisible at merge time, invoiced at the next incident, and unpayable by refactoring because it was never in the code. When production surprises everyone, which it eventually does, response runs at comprehension speed, not verification speed. The relocation is real progress on rate-matching and position; the unpriced cost is that observation narrowed from "what the system does" to "what the spec foresaw."

**Relocation three: upstream into a classifier.** Risk-routing — the most operationally mature answer, and Osmani's — keeps the full human control point but only for changes that deserve it: humans own high-blast-radius merges, spot-check the routine, and let tooling triage the rest. "The bottleneck did not disappear; it moved to verification," he writes, and his model keeps a human answerable for every consequential merge, which preserves attribution where it matters most. The subtlety is what happened structurally: the control point is now the _classifier_. Whatever decides "routine" versus "consequential" — a heuristic, a model, a tired tech lead at 5 p.m. — inherits the position the reviewer used to hold, with a fraction of the scrutiny. Sampled control is a legitimate engineering pattern; every load balancer health-checks a subset. But the sample only controls the flow if the sampler is trustworthy, and the changes most likely to be misclassified as routine are precisely the ones whose risk nobody understood yet. The serial stage did not disappear here either. It moved into a smaller, less examined box.

Against all three relocations stands the behavioral data, which says most of the field has not relocated its control point at all — it has let it fail in place. Sonar's [State of Code survey](https://www.sonarsource.com/company/press-releases/sonar-data-reveals-critical-verification-gap-in-ai-coding/) found 96% of developers do not fully trust AI-generated code, and only 48% consistently verify it. Half the profession is merging code it distrusts, unread and unverified — not because any camp proposed it, but because that is what a saturated checkpoint produces: bypass, wearing the name tag of control.

## Where is yours?

There is one relocation the debate keeps circling without quite landing on, and I will sketch it only as a shape to think with: control as a _gradient_ rather than a gate. No functioning team gives a new engineer root on day one; autonomy is earned per domain, from a track record, and revoked by incident. Pointed at agents, that becomes an autonomy budget — merge-unread as a privilege earned per task class and clawed back automatically by escaped defects, the way an error budget governs release pace. Regulated engineering is closest to it already: a [graduated-oversight framework](https://arxiv.org/abs/2606.22484) published in June 2026 routes every change into one of three tiers — human-in-the-loop, human-over-the-loop, automated-with-monitoring — by regulatory impact, reversibility, and data sensitivity. That is a gradient calibrated by blast radius, which is knowable up front; the one I am describing is calibrated by track record, which is not. I find the shape attractive and do not fully trust it: calibrating the budget is judgment, so the serial stage moves upstream yet again, and an agent's track record was earned under yesterday's model — a silent update invalidates the ledger in a way human experience never does. A gradient that decays on the wrong clock is a gate with better marketing.

Which is where I have to stop, because the evidence does not currently support anyone's certainty, including mine. The same literature that measures defect rates exploding also measures [83.8% of agent PRs accepted by open-source maintainers](https://arxiv.org/abs/2509.14745), more than half merged without modification. Both findings are careful, both are current, and anyone selling a settled answer to the review bottleneck is ahead of the data.

So instead of an answer, the three questions I keep circling — put to you the way I would put them in a design review where the design is the profession's:

* **Where is your control point today — actually, not nominally?** Trace one consequential change from brief to production and mark the place where a human could still see it, judge it, and stop it. If you can't find that place, you don't have a bottleneck problem.
* **What does it still control, and what has it quietly stopped controlling?** Review used to carry five things at once — defects, intent, knowledge, accountability, coherence. Whatever your point controls now, the difference between that list and this one is being given up today, chosen or not.
* **What evidence would you accept to move it?** Merging unread is relocating control to something — a test suite, a classifier, a track record. Name the something, name the evidence — and ask whether you would have accepted that same standard from a dependency in December 2021.

The control point held for twenty years because nothing ever out-ran it, so nobody had to say what it was made of. Something finally does — and an incident will answer these questions for any team that doesn't answer them first.