TL;DR
The short version
Once any teammate — or an agent — can open a pull request, the volume of code to review grows faster than the humans reviewing it. Reading every PR one-on-one stops scaling.
A roughly one-page agent that reads the exact diff, scores the risk, and auto-approves only the low-risk PRs clears the queue — while a human still clicks merge on everything that matters. Claire Vo builds one live on How I AI using Vercel's open-source Eve framework.
Built on the 5 Aug 2026 episode of How I AI with Claire Vo. Intercom's 5x-faster and auto-approval figures are Intercom's own reported numbers, verified against their engineering blog.
Review is the bottleneck now
Your team figured out how to code with AI. Now there's a queue of pull requests nobody has time to read — and that queue is the real problem. When any teammate or an agent like Devin can open a PR, review volume outruns the reviewers.
Claire Vo makes the uncomfortable call: you don't have to review every PR one-on-one by a human. Intercom already proved it in production.
Intercom, "AI is approving our pull requests" (their reported figures)
Speed was the obvious win. The quieter one: a scoped AI review can be safer than a tired human skimming a diff.
Score the risk, read only what's risky
The move isn't "trust the AI." It's triage. The agent reads the exact diff and scores risk on a handful of factors: change surface and blast radius, reversibility, whether it touches data security, operational impact, and a "verification gap" — are the tests and CI actually complete? It layers repo-specific buckets on top: docs are low risk, feature logic medium, authentication and billing high. Diff size alone does not set risk.
A script turns that into a number. Low-risk PRs get auto-approved; medium and high escalate to a human; anything with a blocking failure gets a request-for-changes. Claire's bot showed all three live — a docs change auto-approved, a docs change blocked for merge conflicts, and a 35-file deprecation that scored medium and stayed in the human queue because it changed server API behavior.
Building it was mostly writing instructions
The intimidating part turned out to be small. She built it on Vercel Eve, an open-source framework where an agent is "just a directory" of instructions, skills, and tools that can talk in Slack and GitHub out of the box. Managed connectors handle the Slack/GitHub wiring — permissions, refresh tokens, the usual pain — through a setup wizard. The whole agent is about one page of markdown: instructions, a skill to read the PR, two tools, and a Slack notifier.
Writing these agents is not that hard. It is literally just writing instructions and skills.
Claire Vo, How I AI [15:12]
She built it in a near-one-shot Codex session and didn't even hand-write the risk thresholds — Codex chose them. The best trick: she pointed Codex's browser-use at the GitHub-app and Slack-bot config screens and let it click through the permission wizards while she handled 2FA and pressed save. If you can write code but dread third-party SaaS setup, that hack alone is worth stealing.
Keep a human on the merge button
This is the part that makes it safe for a regulated team. A bot can't satisfy GitHub's required-approval rule, which many teams need for SOC 2 — so Claire doesn't fight it. The agent does the real review, posts a gray check, and pings the team in Slack: risk is low, checks are green, smash approve and merge. A human still clicks — but on a decision the agent already made near-effortless.
We can put AI to work for us or we can have AI put us to work. This is an example where you do both.
Claire Vo, How I AI [20:26]
Auto-approval and compliance aren't opposites. You can do this, in her words, "as long as it's in your risk policies... auditable, queryable, and defensible" — with your security team, not around them.
The step most people skip: evals
One boundary to respect: an unreviewed scoring agent drifts. The teams doing this well, Intercom included, run evals on the reviewer itself — every review is logged, and an engineer periodically judges whether the agent scored it right. Treat your internal code-review bot the way you'd treat a customer-facing AI feature, because this one has its hands on production code.
