Beyond the Green PR: Human Control for Agentic Java
HITL and EU-aware governance for brownfield systems
Who I am
 |
Juan Antonio Breña Moral Engineering @ IG Group, EU Division
Twitter | GitHub | LinkedIn |
|
"Make it work, make it right, make it fast." - Kent Beck "Lead me, follow me, or get out of my way.", "Pressure makes diamonds." - George S. Patton Jr. |
|
Source: Leavitt's Alignment Model (1965) >> People, Process and Technology
Framework
Agenda (30 minutes)
- A green PR can still be wrong · 10 minutes
- HITL at the PR: from review to decision · 11 minutes
- Governance that changes engineering decisions · 6 minutes
- Classify, challenge, and trace · 3 minutes
ACT I
A green PR can still be wrong
Implementation accelerates. Context and review capacity do not.
Everything can be green—and production can still break
💥 Production breaks
The checks proved the implementation—not the whole consequence.
A locally correct Java rename can break the system
RenamecustomerIdtoclientId.
record Order(String clientId, BigDecimal total) {}
Locally correct. What else depends on this contract?
Brownfield context does not accelerate with the code
Working software
Behavior already exists in code, data, and operations.
Fragmented knowledge
Decisions and ownership span teams, repositories, and time.
Live dependencies
Consumers and contracts can fail outside the changed repository.
AI can produce the rename quickly. Discovering its consequences still requires people, evidence, and time.
System awareness changes the implementation strategy
Repository-only view
Rename customerId
to clientId
System-aware view
- Introduce
clientIdcompatibly - Read and write both names
- Migrate and observe consumers
- Remove
customerIdafter adoption
Same requirement. Different context. Different plan.
Parallel Change: expand → migrate → contractAgents see tasks first; dependency failures live beyond them
Most coding agents start at task and repository.
Many
dependency failures live outside them.
Agentic speed makes conventional PR review insufficient
Usually visible
Diff
Repository tests
CI status
Agent summary
Often missing
External consumers
Uncertainty
Applicable controls
Decision authority
Without system context, a merge approval can become cosmetic oversight.
ACT II
HITL at the PR: from review to decision
Classify → Expose evidence → Route → Decide → Observe.
The PR control loop turns review into a decision system
Impact + uncertainty
Context + evidence
Accountable reviewers
Approve · modify · escalate · stop
Outcome + corrective action
Autonomy may propose. Authority must decide. Evidence must connect the two.
Why green PRs can still fool humans
Green and polished feels safe
The agent writes code and tests
Consequences live elsewhere
Generation outpaces review
A human presence does not guarantee a human judgment.
Meaningful HITL requires sight, accountability, and power to act
Context + evidence
Competence + authority
Time + intervention
Without them, approval is human-as-a-button.
2 — Expose the rename as an evidence package
Requirement and scope
Known consumers
Risk classification
Compatibility strategy
Assumptions and limits
Required owners
Consumer evidence
Rollout and rollback
Monitoring and audit trail
The diff proposes the change; the evidence package makes the consequence reviewable.
Challenge the evidence before accepting the claim
“The customerId migration was validated successfully.”
Checks are green.
The diff looks reasonable.
APPROVE
Which consumers were checked?
What remains unverified?
How is compatibility preserved?
What triggers rollback?
3 — Route the PR to accountable reviewers
Domain + system owners
Security + platform
Privacy + data owners
Business + compliance + safety
The right reviewer depends on the risk, not on who is available.
4 — Decide: approve, modify, escalate, or stop
Evidence is sufficient
Request changes or more proof
Another owner must decide
Risk or uncertainty is unacceptable
A reviewer needs real alternatives to “Approve.”
5 — Observe: merge is not the end of the loop
Monitor, roll back, preserve evidence, and improve the control that failed.
Prediction ↔ outcome ↔ corrective action
ACT III
Governance that changes engineering decisions
Laws, standards, and frameworks become useful when they change engineering decisions.
Governance is a control stack
HITL is the decision mechanism connecting policy to execution.
Three trigger families keep governance actionable
EU AI Act
Classify the system and use case · define oversight when applicable
GDPR
Minimization · access · retention · rights · accountable data owner
CRA · NIS2 · DORA
Supply chain · vulnerabilities · continuity · incidents
These are routing signals—not final applicability determinations. Put broader product, platform, and market lenses in the appendix.
The rename raises three different governance questions
OpenAPI · Kafka · Flyway
Compatibility plan + consumer owners
AI-assisted development
Generated artifacts + limits + human decision trace
Applicable AI · data · resilience classification
Specialist owner + required controls
Development governance controls the agent-created PR. System regulation depends on what the deployed system does and where it operates.
CLOSE
Classify, challenge, and trace
Turn human presence into accountable human judgment.
What can a team do next Monday?
- Label agent-created PRs and record generated artifacts.
- Add risk triggers to the PR template.
- Route high-impact changes to accountable specialist owners.
- Require explicit limits, rollback, and monitoring evidence.
- Review incidents and near misses as control failures—not only code failures.
A green PR is evidence—not permission
Agents may propose.
Accountable humans decide.
The system must remember why.
Classify · Challenge · Trace
References
Q&A?
🙏 Thank you 🙏
Appendix: standards make governance repeatable
ISO/IEC 42001
AI inventory · ownership · generated-code review · provider and data boundaries · risk treatment · monitoring · corrective action
ISO/IEC 25010:2023
Functional suitability · performance · compatibility · interaction · reliability · security · maintainability · flexibility · safety
Appendix: additional EU routing signals
Data Act · DSA · DMA
Product Liability
MiFID II · MAR
Use these as prompts for accountable legal and compliance owners, not as automatic applicability claims.
Slides
Slides
jbang trust list
jbang cache clear
jbang catalog list jabrena
jbang qr-code@jabrena \
--url https://jabrena.github.io/plinth/dvbe26/