Roll out in three phases of about 30 days: observe with manual approval on a small pilot, widen to more repositories with written merge criteria, then consider limited automatic merging for one low risk category. Keep a pause switch and a rollback plan throughout.
Days 1 to 30: observe
Choose two or three pilot repositories with owners who want this. Keep every category on manual approval. Set a cap on open pull requests and route them to code owners.
Track three numbers from the start: merged unchanged, merged after edits, closed unmerged. Also record the time from pull request to first review. These become your baseline.
Deliverables by day 30: a pilot list, a reviewer checklist (see the fix PR reviewer checklist), and a rollback plan using the rollback template.
Days 31 to 60: widen and write the rules
Add repositories in batches of five to ten, prioritising those with good tests. Review the baseline numbers weekly.
Write merge criteria for the lowest risk category, for example: patch level change, all required checks green, owner approved, no license change, no new transitive packages. Put them in a document and share them.
Deliverables by day 60: written criteria, required status checks set on pilot branches (see required checks for automated fix PRs), and a decision on which repositories stay manual only.
Days 61 to 90: decide on autonomy
Look at 60 days of data. A category earns more autonomy only if:
| Test | Threshold you set in advance |
|---|---|
| Unchanged merge rate | High and stable for several weeks |
| Revert rate | Near zero |
| Rollback tested | Yes, with a drill |
| Owner agreement | Written |
If the data passes, allow limited automatic merging for that one category in repositories that meet your criteria. If not, extend the manual phase. Neither outcome is a failure.
Controls to keep throughout
- A documented way to pause everything in a minute. See kill switch design.
- Audit records of who or what approved each change.
- A monthly review of the thresholds.
Common mistakes
Starting with the biggest, oldest repository. Turning on several categories at once. Treating a quiet month as proof. Skipping the written criteria, which makes later disputes about what was agreed.
Where Safeguard fits
Safeguard's autonomous remediation ships off by default with every category on Manual, so the first phase is the starting state. Policies and gates express the merge criteria. Begin with a free scan.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how a gate decides whether a pull request may proceed.
Quick check
Is 90 days a fixed schedule?
No. It is a template. Slow down if the numbers do not support the next step.
Do we need automatic merging at the end?
No. Many teams stay on manual approval permanently for most categories.
Last reviewed: 19 October 2026.
