Plan approval: the human gate before code

Why a gate here

Reviewing a proposal is cheaper than reviewing a diff. A wrong direction caught at this point costs a few minutes of reading; caught after implementation, it costs a full run and its tokens. That is why an agentic pipeline puts its main human checkpoint between planning and code.

How it works in DevFlow

When the planner finishes, its output enters plan review. You have three choices: approve, edit it inline, or reject it with written feedback. Rejection sends the feedback back to planning for another pass.

Questions the planner asked, and your answers, stay attached. The reasoning behind the proposal is therefore visible during review.

Approving triggers decomposition into subtasks. With the default setting, implementation then starts by itself; a workspace can switch that off so the work parks until someone clicks Start implementation.

With autopilot

Autopilot is opt-in. It turns analyzed attention items, such as a triaged Sentry issue, into new work and starts planning without a click.

Its limits are a minimum severity of high, a maximum complexity of moderate and at most 3 open autopilot items, all adjustable per workspace. Autopilot planning runs in the batch lane, so the spend cap and scheduler bounds still apply.

Even then, the gate stays. Nothing past planning is automated, and the final mark-done remains a human action.

On the record

The approval and its actor are written to the history. The merge evidence report lists this step and mark-done as the human gates, so the pull request shows who signed off.