withvibe
Sign in
Concepts

The agent gate

Once humans approve a feature env, the agent gate runs as a final automated review. It's the safety net that lets non-technical teammates drive without putting the codebase at risk.

The four default agents

  • Security — looks for injected secrets, dangerous shell calls, unsafe deserialization, OWASP-top-10 patterns. Cross-references the diff against your dependency manifest.
  • Code review — style, complexity, dead code, missing error handling. Uses your workspace conventions (loaded from CLAUDE.md or AGENTS.md).
  • Tests — runs the test suite inside the env container, then evaluates coverage delta. Flags new code paths without tests.
  • Policy— workspace-defined rules. License check, file-path bans (e.g. don't touch infra/), data-handling policies.
Run in parallel
All four run concurrently against a snapshot of the env's branch. A typical gate completes in 1–4 minutes for a feature-sized change.

Outcomes

An agent can return one of three verdicts:

  • Pass — no concerns.
  • Pass with notes — non-blocking observations the team should see.
  • Block — concrete reasons the change should not merge as-is.

If anyagent blocks, the gate fails. The env reopens, the conversation gets a message from the blocking agent with details, and the team iterates. There's no “override” button by design — but admins can disable an agent at the workspace level if it's consistently wrong for your codebase.

Customizing the gate

Each workspace ships a withvibe.gate.yml at the repo root:

agents:
  security: true
  review: true
  tests:
    enabled: true
    command: "pnpm test --silent"
    coverage_min: 70
  policy:
    enabled: true
    rules:
      - "no_changes_to: infra/**"
      - "license_check: MIT"
custom:
  - name: "design-system"
    prompt: "Review changes for compliance with our design tokens..."

Adding your own agent

Custom agents are just a name and a prompt. They run with the same diff context as the defaults and report into the same Pass / Notes / Block model. Common examples teams add:

  • Brand voice / copy review
  • Accessibility (WCAG) checks for UI changes
  • Cost / cloud-resource impact for infra changes
  • Privacy / GDPR review for changes touching user data

Why a gate, not just CI?

CI catches what tests catch. The gate catches what code review catches — the judgment calls. With AI doing more of the typing, you need more than CI to feel safe shipping.

PreviousAgents & orchestrationNext Human in the loop