Anthropic's Claude Code team says merged pull requests more than doubled between June and September while the share reverted fell by more than 40%. Its October 15 account describes human approval scaled to risk in repositories separate from Anthropic's main monorepo. These are the team's own measures; they do not establish what caused the improvement.

Engineering leads can use the public Code Review service to gather findings while setting their own merge requirements. The service reports suspected defects; the team decides which checks and people can permit a change to ship.

The big change

  • What changed: AI review can examine a proposed change and its surrounding code, verify suspected bugs and put the surviving findings beside the relevant lines. That gives engineering teams another source of review evidence as agents produce code.
  • Why it matters: The public reviewer reads code without executing it and grants no permission to ship. Tests and repository approval rules are separate decisions that an engineering lead must configure.
  • What to watch: Review frequency affects spending, and a budget limit can cause reviews to be skipped. Teams adopting the service need to distinguish a completed clean review from a review that never ran.

The internal process assigns approval by risk

The Claude Code team's sequence combines tests, agent reviews, security review and continuous integration. A merge queue precedes staged release; flags and rollback handle recovery.

Its approval policy for trusted authors is:

Change risk

Required human approvals after automated checks

Low, including copy and internal-only features

None

Medium, including ordinary product changes

One

High, plus paths designated for two reviewers

Two

The person directing an agent counts toward the requirement; an agent's approval does not. Approvals cover a specific commit. After three review rounds, the reviewer asks the author to reconsider the approach. Later passes narrow to the new diff. Reverts and incidents are guardrails, with no automatic control yet to tighten approval when they worsen.

What the public reviewer does

The current Code Review manual describes multiple agents reading the diff and nearby code on Anthropic infrastructure. A verification stage checks proposed findings, then the service removes duplicates, ranks severity and posts comments and a check run. It reads code without building or executing it. Its check run does not fail a pull request, and the service never approves or blocks one.

Access requires a Team or Enterprise organization and GitHub repositories. The manual excludes organizations using Zero Data Retention, the HIPAA configuration or customer-managed encryption keys. Those restrictions matter before a team sends proprietary code for review. BIG CHANGE reviewed the documents; it did not deploy or test this workflow.

The setup instructions require a Claude organization Owner, a GitHub organization owner to install and link the app, and repository write access to add repositories. The app requests permissions broader than those a review itself uses. Administrators choose Quick, Standard or Deep reviews and whether they run once per pull request, after every push or on request. Automatic review skips drafts and forks; someone with write access can request a review manually.

Instructions and enforcement have different jobs

The customization manual distinguishes CLAUDE.md, which supplies project context, from REVIEW.md, which sets review-specific priorities and exclusions. The service reads review instructions from the base or default branch, never from the proposed change itself. The local /code-review command reads CLAUDE.md but not REVIEW.md. Guidance shared by both tools therefore belongs in CLAUDE.md.

Repository rules provide enforcement. GitHub's branch-protection documentation describes required status checks, code-owner approvals and resolution of review conversations. It also supports dismissing approvals when the reviewed diff changes. Administrators can normally bypass protections unless the rule applies to them too. An engineering lead therefore needs to inspect the effective rule and its bypass permissions alongside the reviewer's comments.

The public reviewer, as documented, supplies neither a passing application test nor a required human approval. Keeping those records separate makes it possible to check what evidence supported a merge.

Measure the reviews that ran

Code Review billing uses tokens through usage credits, separately from a plan's included usage. Anthropic publishes no flat price per review. Cost varies with review depth, the change and surrounding code, and the findings that need verification. Reviewing every push adds reviews to the same pull request.

The cost manual recommends a limited pilot, a monthly spending limit and measuring the repository's average cost. Reviews can be skipped when the service limit, organization limit or credit balance runs out, including when the remainder is below the expected cost of a review. A skipped review produces a comment explaining the cause.

During a pilot, confirm that the intended reviewer ran on the intended change, required tests and human approvals still apply, and the team can reverse a bad release. Establishing a benefit elsewhere requires the adopting team's own review, revert and incident records. BIG CHANGE's earlier coverage of code output and completed work examines a separate firm study.

Sources & further reading