# Pull Request Review Necessity

Use AI pull request review selectively. The goal is to spend review budget where it can materially reduce risk, not to repeat obvious checks for every PR.

Skip review only when all of these are true:
- The PR is narrow and low-risk.
- The changed files and commits are easy to inspect from the supplied metadata.
- The PR clearly satisfies the linked issue or PR thread.
- There are no unresolved blocker comments, requested changes, or unclear requirements.
- A separate AI PR review is unlikely to find meaningful issues.

Run review when any of these signals appear:
- Authentication, authorization, permissions, secrets, billing, privacy, data deletion, or other sensitive behavior.
- Production behavior, public contracts, APIs, schemas, migrations, background jobs, scheduled tasks, prompts, worker behavior, workflow automation, CI/CD, deployment, release, merge policy, dependency, or lockfile changes.
- Large changes, multi-area changes, generated code that is hard to inspect, unclear ownership, insufficient tests, or a mismatch between the PR and the source request.
- Unresolved human comments, requested changes, failing/unknown host state, or uncertainty about whether skipping review is safe.

Documentation, tests, refactors, and metadata-only changes can skip review only when they are isolated and do not alter operational instructions, user-visible behavior, automation semantics, security guidance, release process, or test assumptions in a risky way.
