More than one in five code reviews on GitHub now involves an AI agent. Copilot's automated review has run over sixty million times, growing tenfold in under a year. Machine-generated pull requests look plausible, because plausibility is what language models optimize for. They may be subtly and uniformly wrong. They often carry no author intent, and rarely disclose which model or prompt produced them.

Reading every pull request carefully is exactly what kills a project. Per-unit review scales linearly with hours, while the queue produces entropy faster than any human can read it. The practical shift is to triage before review. Instead of asking 'is this code correct?', ask the cheaper question: 'does this pull request deserve attention at all, and if so, how much?'

AI coding agents are accelerating the shift by moving the backlog from tickets to pull requests. Code increasingly exists before a team has decided whether the work is valuable or how it should be prioritized. Among companies in the 90th percentile of coding-agent adoption, autonomous agents open 35% of PRs. CodeRabbit calls this Agentic Change Management.

Borrow LangGraph's customer-support shape: a Classify Intent node routes by urgency and topic; a Human Review node escalates. That pattern maps directly to issue and PR triage.

Use an LLM to classify issues and PRs by type: bug, feature, question. Estimate complexity from code references. Automate initial responses with templates for common categories. Route ambiguous cases to a human review node. The classification step should be cheap. A single LLM call can tag an issue and flag whether it references code that changed recently. For prioritization, use a simple formula: priority equals urgency times estimated complexity. Urgency comes from issue type and how recently the referenced code changed. Complexity for a PR comes from the number of files touched and whether tests exist; for an issue, it comes from the scope of code the issue references. Then map priority tiers to response targets: P0 security or regression gets a maintainer same-day, P1 bugs go to the human review node, P2 questions get a templated auto-reply. The same LLM call can output the priority tier, so classification and prioritization happen in one step. A security regression in a core library would trigger a P0, while a question about a configuration option would be P2. This scheme forces maintainers to define what matters before the flood arrives.

Set explicit governance rules. The Dark Factory repository ships its own code using AI workflows that triage issues, implement them, review, and auto-merge with no human reading the diff. Humans still file issues and promote releases. A deliberate human-authored perimeter, including auth, rate limiting, deploy configs, and governance files, is auto-rejected if touched. That perimeter is a concrete example of the guardrails maintainers can set: define what the AI may touch, and let it handle the rest.

The loop-based architecture behind these workflows is covered in Loop Engineering: The Pragmatic Core of LLM Agent Design, which explains how to structure AI agents for reliable execution.

Train the classifier on project-specific labels and historical triage decisions. Define a small set of labels that match your project's workflow, such as bug, feature, question, and documentation. Clear labels also make the audit easier, because there is less ambiguity in what each label means. Use the issue tracker's history as ground truth: each issue's final resolution (bug, feature, question) is a training example. A classifier trained on the labels your maintainers actually use will misroute less often than one starting from scratch.

Regularly audit AI-suggested labels against maintainer decisions. Schedule a weekly review that compares AI labels to the maintainer's final routing. Flag any label that consistently differs, and retrain the classifier on those cases. The audit should also check for false negatives, such as a security issue labeled as a question. This catches systematic bias before it becomes entrenched.

Not every project should accept AI PRs. The decision to automate is a governance choice, not a technical necessity.