Agent Output Review Gate (QA)

Agent Output Review Gate (QA)

1. 01

   Define the review tier for each repository before any agent commit lands

   Tier A (client-facing, payment, auth) requires line-by-line human review; Tier B (internal tooling) allows sampled review at 20 percent; Tier C (throwaway scaffolds) logs only. Publish the tier map in the repo README so delivery leads and contractors apply the same rule.

2. 02

   Run a diff-visibility pass on every agent session before merge

   Tools such as Agent Monitor render a live graph of files, classes, and functions touched, with per-file risk notes. Use that view to flag unexpected file deletions or dependency bumps that the prompt did not request.

3. 03

   Replay parallel agent sessions to catch collisions

   When two or more agents edit the same repository concurrently, replay session logs (claude-bulkhead is one utility for this) and count overlapping writes. Any collision above zero means the branch must be rebuilt from a clean base.

4. 04

   Verify generated code against the client's existing error-handling conventions

   Pull the exact error strings the agent introduced and check them against documented causes and fixes for the libraries in use (ErrLookup indexes axios, express, flask, docker and six others). Mismatched error handling is the most common review rejection.

5. 05

   Confirm the agent did not cross scope boundaries set by the client contract

   Anthropic's November 2026 update to Claude Code blocks re-creating existing video games, a reminder that vendor guardrails shift without notice. Re-read the current system-prompt restrictions for each agent CLI in the stack before signing off on game-adjacent or clone-adjacent client work.

6. 06

   Log the review outcome and reviewer initials in the delivery ticket

   Record tier, reviewer, number of files changed, and whether the agent output was accepted, amended, or rejected. This log becomes the evidence trail when a client asks who approved a production change.

7. 07

   Escalate any Tier A rejection to the architectural owner before the next agent run

   A rejected Tier A commit signals the prompt or context was underspecified. The architectural owner rewrites the task brief and re-runs; the same agent session is not retried unchanged.