On October 15, 2026, Anthropic moved Claude Code Review out of research preview and made it generally available for Claude Team and Enterprise plans. While the performance metrics—cutting review time from 20 minutes to 6-10—are impressive, the architectural decision that matters most to agent safety is how the system handles its configuration. Claude Code Review reads its instruction file, REVIEW.md, exclusively from the pull request's base branch or the repository's default branch. It never reads the version modified within the PR itself.

The Anti-Hijack Design Pattern

This constraint closes a critical vulnerability in agentic workflows. If the reviewer read its rules from the PR branch, any developer could ship a friendlier REVIEW.md alongside their code to loosen the standards used to judge it. By forcing rules to come from the protected base branch, Anthropic ensures that new standards must be merged and reviewed separately before they apply. This aligns with the OWASP Top 10 for Agentic Applications, which lists agent goal hijack and context poisoning as top risks. A rule that the agent can edit is just a suggestion; a rule it cannot edit is policy.

Policy Must Be Protected, Not Just Written

The documentation makes it clear that instructions which make the reviewer quieter—such as lowering severity thresholds, capping the number of 'Nits', or skipping specific file paths—require the root REVIEW.md to sit on a protected default branch. If branch protection cannot be confirmed, the review may ignore the custom rules entirely. This creates a clear separation of concerns: instructions that add scrutiny do not require the same protection level as those that reduce it. It is a subtle but powerful enforcement mechanism that prevents teams from quietly weakening their security posture through configuration drift.

Standards Are Only as Good as Their Owner

Industry data suggests most teams are not ready for this level of discipline. According to Qodo’s State of AI Code Quality 2026 survey, only 41.7% of engineering leaders reported having centralized AI coding standards, and just 37.0% could enforce policy across teams. Liz Fong-Jones, a senior engineer at Honeycomb, emphasized on a recent podcast that teams must 'deliberately defend your codebase' by writing down standards. Without a named owner and a process like CODEOWNERS, instruction files like REVIEW.md rot. Emilie Schario noted that one team’s CLAUDE.md had not been updated in 12 months, a lapse that renders the agent’s context stale and potentially dangerous.

Teach the Agent Before It Codes

Review time is the latest point to apply a standard, meaning every violation caught is work an agent already did and someone now has to redo. Qodo’s approach moves the standard upstream, using tools like Rule Miner to extract recurring patterns from PR history and feed them to coding agents via skills like Get Rules. This ensures the agent knows the rules before writing the first line, rather than just being judged by them after the fact. Anthropic’s split between CLAUDE.md (project context) and REVIEW.md (review criteria) supports this, but teams must actively link these files to avoid drift.

Key Takeaways

  • Immutability is Critical: Agents must not be able to modify the instructions used to evaluate their own output; changes must go through a separate, protected merge.
  • Protection Asymmetry: Rules that reduce scrutiny (nit caps, severity downgrades) require strict branch protection, while rules that increase scrutiny are less sensitive to tampering.
  • Ownership is Non-Negotiable: Instruction files need a CODEOWNERS entry and regular pruning to prevent drift, as they lack the automated tests that keep code healthy.
  • Context vs. Review: Keep project context (CLAUDE.md) separate from review criteria (REVIEW.md) to avoid conflating what the agent knows with how it is judged.

The Bottom Line

Anthropic’s base-branch lock is a necessary guardrail for an era where agents write code, but it is not a substitute for engineering discipline. Teams that treat REVIEW.md as static documentation will fail; you must treat it as living policy, owned by a human, protected by branch rules, and fed to the agent before it starts coding.