Stop asking one model to "find bugs" in a diff. The reviews that catch breaking changes are pipelines that go and look at the rest of the repo first.
Why this, for you: the AI reviewer that comments on a comma but misses that your one-line change broke
three downstream services isn't dumb — it's under-architected. It only ever saw the diff. Knowing the
real anatomy of an agentic review tells you exactly which stage is missing when a reviewer keeps shipping shallow comments.
Traditional AI review works on the diff alone — the changed lines, stripped of the architecture around them.
An agentic review is something else: a tool-calling loop that explores the repository, reads linked issues,
and traces dependencies before it writes a single comment. It is a pipeline, not a prompt.
1 The shift: tools, not just data
The defining move of agentic review is giving the reviewer tools, not just the diff. A reviewer that can
read files, search the tree, and trace call sites produces more accurate findings than one that only sees the changed lines.
GitHub Copilot code review made exactly this shift — public preview in October 2025, GA in March 2026 — moving from line-level
syntax to architectural effects, pattern violations, and cross-cutting concerns.
An agentic review is a pipeline over the diff: gather context → plan → analyze (hybrid) →
report. "Ask an LLM to find bugs in this patch" skips the first three stages — which is why it can only see what the patch
literally contains.
With context-gathering tools the reviewer can read files outside the diff to understand call sites and interfaces, examine
directory structure to verify new files follow conventions, and read linked issues to catch gaps where code looks sound in
isolation but misaligns with what the issue actually asked for.
2 Two stages that do the real work
Two pipeline stages separate a deep review from a shallow one.
Hybrid analysis. The system blends LLM detections and tool-calling with deterministic tools. Each method
owns what it is good at:
Together they produce high-signal findings across security and quality — judgment calls where judgment is needed, hard rules
where rules are exact.
Strategic planning. For complex PRs the agent maps out its review strategy ahead of time. This
matters on long pull requests where context is easily lost.
Why planning isn't optional on big PRs
The previous architecture finalized results at the end of a review — and often "forgot" discoveries it
made early. Planning the scan up front means the agent catches problems as it reads, not in a
last-pass scramble that has already dropped the early findings.
3 What the pipeline buys you — and what it costs
The agentic architecture produced an 8.1% increase in positive developer feedback despite slower reviews —
a deliberate trade-off, because meaningful analysis needs computation time. The system also keeps cross-review
memory, recognizing patterns across PRs instead of treating each as isolated.
Here is the same shared-auth-helper PR under both regimes:
# Static diff review — sees only the changed lines→ comments on naming and syntax inside the helper. Ships.# Agentic review — a pipeline over the diff1. gather: read the helper, then file-read each of 6 importing services
2. link: read the linked issue — intended behavior vs. what the diff does
3. plan: map scope — interface, call sites, related tests, docs
4. report: 3 of 6 services rely on the OLD return shape → flags a BREAKING change, by file and line
That breaking-change finding is invisible to diff-only review. But the loop has a cost, and it backfires in named cases:
Small or trivial PRs — a tool-calling loop's fixed startup latency exceeds the value on a typo fix; static review is faster and enough.
Latency-sensitive pipelines — sub-minute CI gates clash with multi-tool round-trips; the 8.1% gain doesn't pay for a blocked pipeline.
Over-reaching comments — wider context lets the agent flag intentionally isolated code; without a persona tuned to project norms, false positives drive reviewer fatigue.
Reading beyond the diff is the whole point — call sites, shared interfaces, test coverage of
affected paths are the cross-file blind spot diff-only review cannot cover. But match the depth to the PR: the pipeline earns
its latency on architectural changes, not on a one-line typo.
↪ Your win: name the missing stage
It's a pipeline, not a prompt — gather context → plan → hybrid analysis → report, not "find bugs in this diff".
Give the reviewer tools, not just data — read files, trace dependencies, read linked issues.
Blend methods — LLM for judgment (architecture, naming), deterministic tools (CodeQL, ESLint) for rule-based issues.
Plan before reviewing big PRs — it stops early findings from being "forgotten" at the end.
Spend the latency where it pays — agentic depth on architectural seams; static diff review on trivia.
Retrieval practice — recall, don't peek
Question 1The defining shift of agentic review is that the reviewer gets…
Question 2In the hybrid approach, deterministic tools like CodeQL and ESLint own…
Question 3Strategic review planning on complex PRs exists to prevent…
Question 4Agentic review's 8.1% lift in positive feedback came alongside…
Question 5 · spaced recall from an earlier lessonFrom Signal Over Volume: AI-authored PRs are most dangerous because they hide a disproportionate gap in…
Ask me anything. Want help deciding which stage your reviewer is missing, or how to wire a deterministic
tool into the loop? Next: Tiered & Tunable Review — routing review depth by risk so you don't pay the pipeline
latency on every PR.