How to stop AI coding agents from merging their own pull requests

To stop an AI coding agent from merging its own pull requests, turn on GitHub rules that require a pull request, an approval of the latest push by someone other than the agent, and required status checks, and keep the agent off the bypass list. Then keep sensitive paths and the review rules on the base branch, where the pull request cannot change them.

That is the whole of governing AI-agent pull requests. GitHub stops the merge. A reviewer such as MergeJudge can only make the verdict stricter, and only if its failing check is required. Steps below use GitHub's own setting names, then MergeJudge's .mergejudge.yml. The same GitHub settings apply if you use another reviewer, or none.

Turn on the GitHub rules that stop a self-merge

In Settings → Rules → Rulesets, add a ruleset that targets your default branch. Classic branch protection under Settings → Branches has the same controls.

1. Turn on Require a pull request before merging, so nobody, including an agent, can push straight to the branch.
2. Require at least one approving review.
3. Turn on Require approval of the most recent reviewable push. Someone other than the last person to push has to approve that push. An approval of an earlier push does not cover a later push by the agent. (Dismissing older approvals outright is a separate checkbox, Dismiss stale pull request approvals when new commits are pushed.)
4. Turn on Require review from Code Owners if a CODEOWNERS file covers sensitive paths (next section).
5. Turn on Require status checks to pass before merging, and add the check named in the required-check section.
6. Leave the agent, its GitHub App and any token it uses off the ruleset bypass list. On classic branch protection, turn on Do not allow bypassing the above settings, and do not list the agent under Allow specified actors to bypass required pull requests.
7. Turn Allow auto-merge off under Settings → General → Pull Requests. Leave it off unless you later opt in to MergeJudge approval.mode: auto-merge-only, which is off by default and needs this GitHub setting on. MergeJudge does not merge pull requests itself. The auto lane is low risk, not a guarantee; branch protection and required checks still apply.
8. Leave Block force pushes on. It is the ruleset default.

Give the agent a token that can open pull requests and cannot bypass these rules. MergeJudge does not merge pull requests itself, and approvals are off by default.

Protect sensitive files from AI-generated changes

Two layers, and neither one is optional if the path matters.

GitHub. Put the paths in a CODEOWNERS file (.github/CODEOWNERS, or CODEOWNERS at the repository root) and turn on Require review from Code Owners. An agent that edits those paths then needs that owner's approval. Example:

.github/          @your-org/platform
**/auth/          @your-org/security
**/migrations/    @your-org/platform

MergeJudge. List the same paths in lanes.protected in .mergejudge.yml on the default branch. A change there is at least review, even with no AI provider configured:

# .mergejudge.yml on the default branch
lanes:
  protected:
    - ".github/**"
    - "deploy/**"
    - "**/auth/**"
    - "**/migrations/**"
    - "wrangler.toml"
    - "_headers"
    - "**/_headers"
    - "**/.env*"
    - "src/billing/**"   # add paths that matter in your repo

Setting lanes.protected replaces the default list, so keep the defaults you still want. The defaults are .github/**, deploy/**, **/auth/**, **/migrations/**, wrangler.toml, _headers, **/_headers and **/.env*. _headers files stay at least review even if you drop them from this list. The full rules are in Sort pull requests by risk.

.mergejudge.yml and policy files such as AGENTS.md are read from the base branch. Changes to .mergejudge.yml always go to review, so an agent cannot loosen the rules in its own pull request. Put judgement calls ("new endpoints must check authorization on the resource") in a policy file.

How to make AI code review a required status check

1. Let the reviewer post a check at least once, so GitHub has the name in the list. MergeJudge's check is named mergejudge/lane.
2. In the ruleset or branch protection rule, turn on Require status checks to pass before merging.
3. Add mergejudge/lane.

What the conclusion means:

Lane	Check	Does a required check stop the merge?
block	failure	Yes
review	neutral	No. GitHub counts a neutral conclusion as a successful required status check. Keep the required human review.
auto	success	No. Low risk, not a guarantee. Branch protection and required checks still apply.

MergeJudge does not merge pull requests itself. A failing check only matters because GitHub is the thing that blocks the merge.

Mark agent pull requests

Have the agent add the mergejudge:agent label, or a line in the pull request body:

MergeJudge-Actor: agent

A coding agent that merges through a person's login can add the same line to the merge message (gh pr merge 123 --merge --body "MergeJudge-Actor: agent"). Agent-marked merges and label changes are not counted as human decisions in learning.

Keep agent pull requests out of the auto lane

lanes:
  trusted_authors:
    enabled: true
    users: ["your-github-login"]   # the auto lane is only for these logins
    applies_to: all_auto           # also covers docs and style auto paths
    agents: untrusted              # agent-marked pull requests never get auto

The author comes from GitHub, so a pull request cannot fake it. Bot accounts are untrusted unless listed exactly. This setting can only take the auto lane away. It does not approve or merge anything. Auto remains low risk, not a guarantee; branch protection and required checks still apply.

Require a pull request description from agents

pr_template:
  enabled: true
  sections: ["Testing", "Risk", "How to revert"]
  min_chars: 15        # real text per section
  apply_to: agents     # agents (default) or all
  missing_lane: review # or block

A missing or empty section raises the pull request to review (or block). Editing the description re-runs the check without a new model call.

What the reviewer adds

• Rules first. Protected paths, a coarse secret screen, removed safety guards (--match-head-commit, persist-credentials: false, set -e, --frozen-lockfile / npm ci) and size limits set a minimum lane. See Sort pull requests by risk.
• The AI can only raise a lane. The one opt-in exception, lanes.code_auto, is off by default, and a pull request cannot turn it on. Pull request content is fenced as untrusted data.
• Your repository's rules. AGENTS.md, CLAUDE.md and REVIEW_POLICY.md from the base branch are given to the reviewer as trusted policy.

Run this inside your own CI, with your own key, with the open-source AI pull request reviewer and the self-hosted GitHub Action. What the product is: What is MergeJudge?.

FAQ

How do I stop an AI coding agent from merging its own pull requests?

Turn on a GitHub ruleset or branch protection rule that requires a pull request, an approval of the most recent push from someone other than the agent, and required status checks. Keep the agent off the bypass list, and do not give it a token that can bypass those rules.

Can an AI agent approve or merge its own pull request?

Not when required reviews are on. GitHub does not count the pull request author's own review as an approving review, and Require approval of the most recent reviewable push means someone other than the last person to push has to approve that push. An agent can still merge if it is on the bypass list, if required reviews are off, or if a person already approved and the agent has permission to merge. MergeJudge does not merge pull requests itself, and approvals are off by default.

Does a neutral check block a merge?

No. A review lane posts a neutral mergejudge/lane check. GitHub counts a neutral conclusion as a successful required status check, so that check does not stop a merge. A block lane posts failure, which does stop a merge when the check is required. Keep a required human review for pull requests in the review lane.

Should AI agent pull requests ever be auto-merged?

Only if you accept that risk for small, low-risk changes, and only behind branch protection and required checks. Auto means low risk, not a guarantee. With MergeJudge you can keep agent-marked pull requests out of the auto lane by setting lanes.trusted_authors with agents: untrusted and applies_to: all_auto. Approvals are off by default.

Can an agent loosen the review rules in its own pull request?

Not with MergeJudge. .mergejudge.yml and policy files such as AGENTS.md are read from the base branch, and changes to .mergejudge.yml always go to review, so a pull request cannot turn on lanes.code_auto for itself. The AI step can only raise a lane, apart from that opt-in, which is off by default.

How does MergeJudge know a pull request came from an agent?

The agent marks it with the mergejudge:agent label or a MergeJudge-Actor: agent line in the pull request body or merge message. Bot accounts are also untrusted under lanes.trusted_authors unless you list them exactly.