Your agents write more of the code than your reviewers can read.

An AI coding agent optimises for the task it was given: the feature works, the tests pass, the diff is small. Nothing in that brief tells it the same change also touched a control your company is audited on: that obligation lives in your frameworks and your context, not in the prompt. As agents open a larger share of your pull requests, that gap between the code being correct and the change being compliant opens on more diffs than a human compliance reading can keep up with.

The volume changed faster than the review did

A human author who touches a security control usually has some sense they are doing it: they know they are touching auth, or logging, or a data store. An agent asked to fix a failing test or ship a feature usually starts with none of that context, so it makes the change that gets the visible job done, sometimes the version that quietly widens a role, drops a log line, or turns off a backup nobody asked it to keep. That is not a defect in the agent. It is a question nobody put in its context window.

heygrc is built to answer that question on every pull request an agent opens, the same way it would for a human one: read the diff against the frameworks you selected, and cite the control a change touches. The review keeps pace with the code because it runs on every PR the moment it opens, it does not wait for a person to notice.