# AI Coding Agent Plan Review Gate Checklist

**Brand:** OperatorForge AI  
**Updated:** 2026-06-15  
**Format:** free checklist + plan-risk rubric + approval template  
**Use when:** a founder, engineering lead, consultant, or agency asks Claude Code, Codex, Cursor, Copilot, OpenCode, Devin-style tools, or background coding agents to write an implementation plan before touching code.

## Why this matters now

The 2026-06-15 scan found a fresh cluster around **plan-phase review and sandboxed execution for AI coding agents**:

- Hacker News surfaced **“Batta – plan-phase security reviews for AI coding agents (OSS)”** on 2026-06-15.
- HN also surfaced **“What are you looking for when reviewing LLM generated code?”**, **“Sandbox AI coding agents with microVMs on Fedora Linux”**, **“Kster.ai – Structured product context your coding agent reads over MCP”**, **“Agents as Code”**, and ongoing Claude/Codex workflow discussion.
- GitHub search found fresh repositories updated on 2026-06-14/15 for per-project microVM sandboxes, agent kernels, sandboxed AWS query runtimes, and governance layers for AI-native projects.
- Reddit JSON checks remain blocked or fragile for this cron profile, so public HN/GitHub sources drove selection.

The monetizable gap: teams are letting agents execute plans that have never been reviewed as plans. The cheapest place to prevent security, scope, cost, and rollback mistakes is **before the first file edit**.

## The 10-minute plan review rule

Before an AI coding agent executes, its plan must be reviewed against explicit risk gates by a human owner. A plan that cannot name scope, files, tests, secrets, permissions, rollback, and evidence is not ready to run.

| Plan surface | Failure mode | Required gate | Evidence to keep |
|---|---|---|---|
| Objective | vague or over-broad task | one measurable outcome | owner-approved scope |
| Files and systems | agent edits sensitive areas unexpectedly | touched-area forecast | sensitive-path review |
| Commands and tools | unsafe shell/network/deploy actions | allowed-command list | command policy note |
| Secrets and data | raw credentials or customer data enter context | secret/data boundary | redaction statement |
| Tests | agent plans only happy-path checks | targeted + baseline checks | acceptance commands |
| Rollback | no recovery if plan fails | rollback step before execution | restore command / snapshot |
| Cost and time | runaway background loops or expensive model/tool calls | budget ceiling | spend/time cap |

## AI Coding Agent Plan Review Gate Checklist

### 1. Force the agent to produce a reviewable plan

- [ ] Require a one-paragraph objective tied to a ticket, bug, or business outcome.
- [ ] Require explicit non-goals: what the agent must not change.
- [ ] Require expected files, directories, services, APIs, and config surfaces.
- [ ] Require the exact commands the agent expects to run.
- [ ] Require acceptance checks before implementation starts.

### 2. Score plan risk before execution

Assign one risk tier before approving the plan:

- **Tier 0 — read-only:** inspection, docs, local analysis, no writes.
- **Tier 1 — local reversible:** small code/docs changes, no credentials, no deploy.
- **Tier 2 — production-adjacent:** CI, database migrations, auth, billing, emails, prompts, MCP config, customer data, or workflow automation.
- **Tier 3 — live authority:** deployment, payments, credentials, destructive commands, outbound messaging, or irreversible data changes.

Approval rule: Tier 2 requires named human approval; Tier 3 requires human approval plus rollback proof and bounded execution.

### 3. Gate sensitive paths and permissions

- [ ] Does the plan touch auth, authorization, billing, payments, refunds, email delivery, production deploy, database migrations, secrets, logging, telemetry, CI/CD, prompts, AGENTS.md, CLAUDE.md, Cursor rules, MCP config, or automation workflows?
- [ ] If yes, name the reviewer and approval criteria before running.
- [ ] Confirm the agent does not need production credentials for the task.
- [ ] Confirm the agent is not allowed to deploy, merge, purchase, message customers, or alter payment settings unless explicitly approved.

### 4. Require a command and tool policy

- [ ] List allowed commands.
- [ ] List blocked commands: destructive deletes, credential dumps, broad network scans, curl-to-shell, package-publish, deploy, billing, or account-administration actions.
- [ ] Decide whether internet access is allowed.
- [ ] Decide whether MCP tools, browser tools, shell tools, and filesystem writes are allowed.
- [ ] Add a kill condition: when the agent must stop and ask for review.

### 5. Require test and evidence commitments

- [ ] Define one targeted test/check that proves the requested change.
- [ ] Define one baseline check that catches collateral damage.
- [ ] Require before/after evidence when fixing a bug.
- [ ] Require file-level diff summary after execution.
- [ ] Require evidence packet before merge or delivery.

### 6. Require rollback before run

- [ ] Confirm clean git status or snapshot point.
- [ ] Capture rollback command or restore path.
- [ ] If data changes are involved, require backup/export proof.
- [ ] If deployment is involved, require previous deployment ID or rollback route.

## Plan approval template

```text
Task / ticket:
Human owner:
Agent/tool/model:
Run ID:
Objective:
Non-goals:
Expected touched files/systems:
Risk tier: 0 / 1 / 2 / 3
Sensitive paths involved:
Credentials/data involved:
Allowed commands/tools:
Blocked commands/tools:
Internet/MCP/browser access allowed:
Budget/time ceiling:
Targeted acceptance check:
Baseline check:
Rollback/snapshot:
Stop-and-escalate conditions:
Approved to execute by:
```

## Minimal GitHub issue / Linear comment prompt

```text
Before implementation, write a plan for human review. Include objective, non-goals, expected files, risk tier, sensitive paths, credentials/data needed, commands/tools you expect to run, tests, rollback step, and stop conditions. Do not edit files or run write/deploy/destructive commands until the plan is approved.
```

## Consultant packaging angle

Sell this as a fast control-layer offer for teams adopting coding agents:

- **$250-$500 AI plan-gate audit:** review one repo/team workflow and define a practical risk-tier rubric.
- **$750-$1,500 agent plan-review implementation sprint:** add issue templates, PR templates, command policies, sensitive-path gates, and evidence packet requirements.
- **$2,000-$4,000 agentic engineering control pack:** combine plan review gates with PR firewalls, sandbox threat models, local firewalls, secret boundaries, observability, rollback ledgers, and cost controls.

## OperatorForge AI upsell

This checklist pairs with the OperatorForge AI Pro Pack bonuses for PR CI firewalls, bug-report injection triage, secret-leak controls, sandboxing, local firewalls, MCP security, authorization boundaries, observability, rollback, verification, instruction governance, skill security, and coding-agent spend controls.