A protected branch is a contract. Whatever lands there is what the team — and the company — has agreed to ship. When a human approves an AI-authored PR, they aren't endorsing the AI; they're stepping forward as the person responsible for that code. The reviewer owns the merge.