How do we require approvals for AI-generated pull requests?

Short answer

Use GitHub branch protection to require a status check, and have that check pass only after a person signs off. DraftView posts a draftview/human-review status on every documentation PR in a connected repo. It stays pending until a maintainer signs off on that exact commit, so GitHub will not merge an unreviewed AI doc PR.

Why required reviewers are not enough

GitHub's built-in required reviews count approvals, not reading. Anyone with write access can click Approve on a diff they skimmed, and an approval often survives later pushes unless you turn on dismissal of stale reviews.

For AI-generated docs, the question an auditor asks is narrower: did a qualified person review this exact version before it merged?

Step 1: catch the pull requests

Connect the DraftView GitHub App to your organization. Every pull request that changes documentation files in a connected repo enters your review queue. DraftView flags the ones that look AI-authored from the author, branch name, description and commit trailers, whichever tool wrote them.

Step 2: make the check required

DraftView posts a commit status named draftview/human-review on each documentation PR. It is pending when the PR arrives and again after any push that changes the docs.

In GitHub, open the branch protection rule (or ruleset) for your default branch and add draftview/human-review as a required status check. From then on GitHub blocks the merge button until the check passes.

Pull requests that change no documentation get an immediate passing status, so the rule never blocks code-only work.

Step 3: sign off on the version you read

A reviewer reads the rendered pages, comments and suggests edits. When the content is right, a member with the maintainer or admin role signs off. The check turns green for that commit only.

Each sign-off is stored as an append-only record with who signed, their role, the commit and the CI result at that moment. If the agent pushes again, the new commit needs its own review.

What to know before you rely on this

  • GitHub enforces the block, not DraftView. The rule only works once draftview/human-review is a required check in your branch protection or ruleset.
  • The merge gate is a Team plan feature. On the Free plan the check reports success with a note that the gate is off, so it never wedges your repo.
  • DraftView covers documentation files. Use your usual code review rules for code.

Common questions

Can the agent approve its own pull request?
No. Sign-off happens in DraftView and needs a signed-in member with the maintainer or admin role. An agent's GitHub account cannot sign off.
What happens when the agent pushes a fix after review?
A push that changes the docs sets the check back to pending. Reviewers are told when a revision touches the part they commented on, and a person signs off again on the new commit.
Can we turn the gate off for one organization?
Yes. Admins can switch the merge gate off in the organization's GitHub settings in DraftView. The check then stops blocking.

Keep reading

Last updated 2026-10-28