AI Writes More PRs. Who Validates Them? — Ali-Reza Adl-Tabatabai, Sonar
Ali-Reza Adl-Tabatabai, co-founder of Gitar (now part of Sonar), explains why AI-driven growth in PR volume and size turns CI and code review into a bottleneck, and presents agentic validation as the way out: automated review, CI failure analysis, autofix, and auto-merge, built up step by step as trust grows, combined with traditional program analysis in SonarQube.
Ali-Reza Adl-Tabatabai, co-founder of Gitar (now part of Sonar), argues that the centralized validation phase of software delivery, CI plus code review, is where quality gates live, and that it is becoming the main bottleneck as AI accelerates code generation. His core claim is that AI-generated code means more pull requests, bigger pull requests, and more defects, which leaves teams with an uncomfortable choice: slow down to review every PR carefully, or rubber-stamp PRs and accept production incidents. His proposed way out is agentic validation, where an agent automates the validation steps and delivers green, mergeable PRs.
Why validation is the critical path
Validation enforces security, compliance, and code quality gates centrally, and it sits on the critical path to production, so faster is always better. As engineering organizations grow, this phase gets slower almost by default. Builds and test tasks run longer, and review flows become asynchronous across time zones and teams. It is also expensive: it depends on many tools that must be integrated and scaled, all running on costly infrastructure. For these reasons it usually falls to the platform team, which is often small and constrained in headcount.
Failures in this phase are especially costly. A single failure introduces an outer loop measured in hours or days, which erodes velocity, wastes developer time, and breaks flow state. Optimizing the phase is hard too, because it is built from fragmented systems stitched together with bespoke configuration and scripts. Automating it with AI is not trivial either, since it requires complex workflow orchestration across asynchronous human interactions and many tool integrations.
Why AI makes it worse
AI increases the volume and size of PRs, and each one can carry defects. Costs in the development lifecycle shift to the right: there is far more code to review and more potential for production failures. Ali frames the resulting choice starkly. Either developers review every PR very carefully and slow down, or PRs get rubber-stamped and incidents follow. Both paths produce unhappy developers, lower sentiment, and much less productivity than teams expect.
Agentic validation as the answer
The proposed answer is more AI, specifically an agentic approach to validation, which Gitar built and is now shipping as part of Sonar. The agent covers the full validation loop:
- Review: When a PR is created, the agent reviews it and posts issues and inline comments. The emphasis is on keeping this as noise-free as possible, both in UX and in only raising issues that are real and matter. Teams can customize reviews with their own rules and custom checks, trigger custom workflow automations, and block merging while unresolved review findings remain.
- CI analysis: The agent analyzes CI failures and posts a summary of root causes. It is especially good at catching flaky tests, and teams can set rules that automatically retry them, which Ali notes is a very popular feature.
- Autofix: The agent can fix code review issues and CI failures, either on request for a specific issue or in a loop that keeps working until the PR is green and ready to merge.
- Auto-approve and auto-merge: Teams can define rules and conditions under which the agent approves and merges green PRs.
Building trust step by step
Ali describes a clear trajectory among users toward fully automated PRs. Teams begin by using the agent for reviews and judging whether its feedback is accurate and important. Once they trust the reviews, they let the agent block PRs. Next they turn on autofix to make PRs green automatically. The final step, where the real leap happens, is writing rules that let the agent approve and merge PRs on its own. Each level of trust unlocks more automation and, with it, more value.
Insights for platform teams and leaders
Because the system processes every PR with AI, it can surface new kinds of insight. For platform teams, a categorization of the top CI failures shows where developers hit problems and whether the root cause is flaky tests needing reliability work, infrastructure issues, or something else. For leadership, a categorization of landed PRs shows how engineering effort is distributed across feature development, issue fixing, chores, refactors, and so on.
Under the hood
Gitar has three main components. A control plane orchestrates PR workflows. A custom agent runtime, or harness, handles multi-agent execution, context and memory management, tool calling, and integrations. Building its own harness let the team optimize specifically for validation, balancing token cost, precision, and coverage, which in turn allows it to guarantee outcomes at a fixed price per PR while keeping quality high. An LLM proxy routes requests across models and handles failover.
Agents combined with program analysis
Since joining Sonar, the team has been integrating Gitar with SonarQube. Ali argues that agents and traditional program analysis are complementary, and that combining them with techniques such as taint analysis, control flow analysis, data flow analysis, and software composition analysis should deliver much better precision and coverage at a good price point than either approach alone.
Outcomes and closing
The reported value spans better quality and security, especially for AI-generated code; faster delivery as PRs move from creation to approval and merge with much less manual work; higher developer productivity and sentiment; and more leverage for platform teams to fix issues, customize workflows, and gain insight into a critical part of the lifecycle. Ali’s closing message is that PR validation matters more than ever in an AI world, that AI turns validation into a friction point, and that automating the step end to end lets teams keep pace with the code AI generates. He points interested listeners to booth P7 for a demo.