AI Coding Agent Plan Review Gate Checklist
A 10-minute pre-flight gate for reviewing Claude Code, Codex, Cursor, Copilot, OpenCode, and background-agent implementation plans before they touch files, secrets, CI, MCP config, or production systems.
Force reviewable plans
Make the agent name objective, non-goals, expected files, commands, tests, and rollback before execution.
Score risk before edits
Use Tier 0-3 gates to separate read-only work from sensitive production-adjacent authority.
Approve commands and evidence
Define allowed tools, blocked commands, budget ceilings, stop conditions, and acceptance checks.
Why this matters now
HN and GitHub signals on 2026-06-15 pointed to plan-phase security reviews, microVM sandboxes for AI coding agents, structured product context over MCP, and governance layers for AI-native projects. The commercial gap is a practical pre-execution plan gate teams can adopt before agent plans become risky changes.
The 10-minute plan review rule
Before an AI coding agent executes, its plan must be reviewed against explicit risk gates by a human owner.
| Plan surface | Failure mode | Required gate | Evidence to keep |
|---|---|---|---|
| Objective | vague or over-broad task | one measurable outcome | owner-approved scope |
| Files and systems | unexpected sensitive edits | touched-area forecast | sensitive-path review |
| Commands and tools | unsafe shell/network/deploy actions | allowed-command list | command policy note |
| Rollback | no recovery if plan fails | rollback before execution | restore command / snapshot |
Risk tiers
Core checklist
- Require a one-paragraph objective, non-goals, expected files, and exact commands.
- Assign Tier 0-3 risk before implementation starts.
- Gate sensitive paths: auth, billing, CI, deploy, secrets, prompts, MCP config, and automation workflows.
- List allowed and blocked commands/tools, including internet, MCP, browser, shell, and filesystem access.
- Define targeted acceptance checks, baseline checks, evidence packet, budget ceiling, and stop conditions.
- Confirm clean git status, snapshot, backup, or rollback path before execution.
Plan approval template
Task / ticket: Human owner: Agent/tool/model: Run ID: Objective: Non-goals: Expected touched files/systems: Risk tier: 0 / 1 / 2 / 3 Sensitive paths involved: Credentials/data involved: Allowed commands/tools: Blocked commands/tools: Budget/time ceiling: Targeted acceptance check: Baseline check: Rollback/snapshot: Stop-and-escalate conditions: Approved to execute by:
Turn plausible plans into governed execution.
Use this checklist as the pre-execution layer before the OperatorForge PR firewall, sandbox threat model, secret-boundary, local-firewall, observability, rollback, and cost-control checklists.