I think the "and merge it" is the problem in the above comment.

If a coworker is creating a ton of AI-made PRs, I think the first step should always be to run an AI against them with the "assume this is low quality code and find all problems, big and small" text that was suggested in a comment here, and let that be the first line of defense.

To keep the dev on their toes, each dev should come up with their own prompt for AI PR review and they can switch off who reviews it each time, until there are no problems remaining.

Then a human can start to review it.

It will quickly show the low quality code being produced and the massive waste of time it is for everyone, not to mention all the money spent on tokens for the whole process.

Or it'll work, and everyone will have their way, and only have to review code that's pretty decent.

> Sadly, in my case, it is the auditor.

Change your auditor and compliance, SOC2 is created for a trust between organizations employing humans, if you think agents can own the things, lead the way, introduce a new compliance, if companies sign up for it, then you will be the first who is removing the human bottleneck.

Bureaucracy gives you leverage against slop. Review seriously, but limit the time that you spend. This will stall the slop. When the culprit complains, tell your boss "I spend X hours per week on reviews. If you need more throughput, the PRs quality needs to improve."