[gchaix]

Summary

Pass the org variable AI_REVIEW_APPROVAL_CEILING to ai-pr-review as the approval-ceiling input. The fallback is request-changes.

• The bot never posts APPROVE. A human must approve every merge.
• A clean, Low or Medium review posts COMMENT. A Critical or High finding still posts REQUEST_CHANGES.
• The change covers the review job and the slash-commands job. A non-default ceiling also stops /ai-pr-review dismiss from approving.
• Reason: SOC2 audit scope found self-merges on PRs.

Effect on merge

The new default applies when this PR merges, with or without the org variable. Set AI_REVIEW_APPROVAL_CEILING at the org level to change the value for all repos. Allowed values: approve, request-changes, comment.

If a branch protection rule or an auto-merge rule waits for a bot approval, change it. Use fail-on-findings: true and a required status check instead. See the approval ceiling docs.

Test plan

• The review job runs on this PR and posts a review.
• The review state is COMMENT or REQUEST_CHANGES, never APPROVED.

[github-actions]

Summary

Passes a new approval-ceiling input to the AI PR review action and the slash-commands reusable workflow, sourced from the org variable AI_REVIEW_APPROVAL_CEILING and defaulting to request-changes. This keeps the bot from posting APPROVE, so a bot approval can no longer let a PR merge without human review (the SOC2 gap noted in the commit message).

Type: config
Effort: 1/5 — two added lines in a single workflow file

Walkthrough (1 file)

File	Change	Summary
.github/workflows/ai-pr-review.yml	Modified	Adds approval-ceiling input (org variable with request-changes fallback) to the review step and the slash-commands job

---

AI Review Summary — generated by ai-pr-review

[github-actions]

AI Review Findings

✅ Overall Risk: None | Findings: 0 (0 inline)

Review cost: $0.0336 · 12,292 tokens · 2 agents · Sonnet 5.5 · full breakdown

Not reviewed: No run of silent-failure-hunter (the trigger for this agent did not fire).

Reply with a slash command to dismiss a finding. See the command reference.

---

AI Review — generated by ai-pr-review

[jeffsheltren]

LGTM — passes approval-ceiling (default 'request-changes') to both the container-action and slash-commands entry points.