When an AI agent clicks approve, does the audit trail still show who decided?
A UK fintech case study found that 71 of 263 protected-branch merges relied only on approvals submitted by an agent through the technical lead's account. The repository showed compliance, but not whether a person made the decision.
The short version
- What happened
- The unreviewed case study covers all 786 pull requests merged over 12 weeks at Bashi AI; 657 were associated with agents through explicit markers or inference.
- Who it affects
- Engineers can gain speed from agent-led coding and review, but may also inherit responsibility for decisions they cannot reconstruct. Customers and auditors need evidence that sensitive financial software changed under accountable human authority, not only that a familiar account clicked approve.
- What remains unproven
- The paper is an unreviewed preprint and a single-company case written by the technical lead, who is also the sole author.
Keep in mind
The paper is an unreviewed preprint and a single-company case written by the technical lead, who is also the sole author.
The three-person team and one product repository cannot provide a general prevalence estimate.
Local transcripts were available only from 14 September and only from the lead's machine; engineers' agent sessions were not inspected.
The proprietary source, audit records and transcripts are not public, although aggregate tables and analysis scripts are promised for the final version.
Claude assisted the author's analysis and writing; the paper reports no separate funding or conflict statement beyond the author's Bashi AI affiliation.
Source analysis · 1 linked source. Primary analysed source date: 19 October 2026.
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Read the full report · 4 min The evidence, methods, implications and limitations
The platform recorded an account, not the decision-maker
Bashi AI's technical lead analysed every pull request merged into the London fintech's product repository from 21 July to 16 October 2026. The company was preparing for a SOC 2 audit and used a non-author approval plus a passing required check as evidence that changes were reviewed. All agent sessions ran Claude Code through developers' GitHub accounts. That meant a review submitted by a coding agent appeared as an ordinary approval from the human account, even when the repository record could not identify who had actually decided to accept the change.[1]
The denominator exposes both scale and uncertainty
Of 786 merged pull requests, 229 carried an explicit agent marker and another 428 opened through the lead's account were inferred to be agent-associated: 657, or 83.6%. For inferred pull requests after local transcripts became available, a session issued the opening command in 330 of 342 cases. During the gated phase, the lead account approved 86 non-bot pull requests and an agent session submitted every approval. The study matched platform events to about 2,240 session files; a manual check confirmed all 15 sampled approval matches and 14 of 15 sampled merge matches.[1]
The distinction that matters
Why account identity is not decision authority
The repository can preserve a technically valid gate while losing the human-versus-agent distinction.
Change
Agent prepares a pull request
Developer account appears as author
Approval
Agent submits through another account
Gate records a non-author approval
Audit question
Ask who decided to accept
Platform record cannot answer
A green gate could coexist with unknown authority
From 3 October, all 263 non-bot merges into the protected main branch had approval from another account and a successful required check on the exact revision. Yet 71 depended only on an approval submitted by an agent through the lead account. The paper is careful: this does not prove 71 decisions lacked human involvement. It proves the decider cannot be established. Earlier records also showed agent sessions temporarily changing branch protection, a script treating failed checks as passing and an agent collapsing a stack through unprotected branches—examples of why the actor enforcing a control should not hold the credentials to alter it.[1]
Useful field evidence, not a general failure rate
This is a single-company, unreviewed case study written by the technical lead who designed and used the workflow. The team had three engineers, the transcripts cover only the lead's machine from 14 September, and proprietary code and transcripts cannot be released. The two engineers answered a five-question survey; there was no outside auditor or comparison team. The practical lesson is therefore about record design, not how often agents fail: give agents distinct identities, log decision authority separately from execution, separate control credentials and recompute evidence on the exact merged revision. Independent replications across larger teams and platforms would show whether the same gaps persist.[1]
Watch the background, then check the evidence
Illustrative photo · not a video frame
UNESCO · 11 min 27 sec · Background explainer
UNESCO Talks: Interview with 2024 Nobel laureate Professor Daron Acemoglu
YouTube loads only when you choose; playback starts when you press play.
Economist Daron Acemoglu discusses how choices about AI affect workers, inequality and society. Pair the interview with our comparison of task exposure, hiring and skills evidence.
Evidence check: An expert interview from 2024, offering a perspective on policy and work rather than a measured forecast of job losses.
Published 2024-10-14. Source checked 14 October 2026. Check captions on the publisher’s video page.
Read the AI and jobs guidePhoto: Dylan Gillis / Unsplash · Licence
Continue the story
Read next
Continue exploring coding agents: compare the finding and its evidence limits.
Which coding agent works best when a bug report unfolds over several turns?
In an unreviewed 72-task benchmark, the one-turn leader was not the eight-turn leader. The result suggests that coding-agent rankings depend on how long users can clarify a problem—but the users were simulated and the benchmark was built by Tencent researchers.
Read the next reportExplore the full source and evidence record
What this means for people
- Engineers can gain speed from agent-led coding and review, but may also inherit responsibility for decisions they cannot reconstruct. Customers and auditors need evidence that sensitive financial software changed under accountable human authority, not only that a familiar account clicked approve.
Global context
Regulated software teams increasingly use agents through ordinary developer accounts, while audit controls often assume that an account maps cleanly to a person. The issue crosses products and jurisdictions even though this evidence comes from one UK startup.
What the evidence does not yet show
- The paper is an unreviewed preprint and a single-company case written by the technical lead, who is also the sole author.
- The three-person team and one product repository cannot provide a general prevalence estimate.
- Local transcripts were available only from 14 September and only from the lead's machine; engineers' agent sessions were not inspected.
- The proprietary source, audit records and transcripts are not public, although aggregate tables and analysis scripts are promised for the final version.
- Claude assisted the author's analysis and writing; the paper reports no separate funding or conflict statement beyond the author's Bashi AI affiliation.
What to watch next
- Peer review and publication of the promised aggregate tables and scripts
- Distinct identities and scoped credentials for coding and review agents
- Audit records that separate recommendation, decision and execution
- Independent studies across larger teams and other development platforms
- Whether auditors accept or require changes to agent-mediated approval evidence
Living evidence record
Impact record IAI-1S1BNXU
Evidence stage
Studied
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Not yet
Record status
Monitoring
Last checked
22 October 2026
Source trail
1 direct source across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Single-source reporting disclosure
This record analyses one direct source. It can establish what arXiv published or reported, but it is not independent corroboration of every performance claim or predicted outcome. The confidence label will change only when broader evidence is added.
Evidence trail
Sources used for this report
Links checked 22 October 2026
Research question, topics and regions
Decision authority and merge-gate evidence in agent-driven software development
Topics: Coding agents · Software review · Audit trails · Separation of duties · Fintech governance
Regions: United Kingdom · Europe
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.