I've always wondered if part of the root issue is that Same-Origin Policy, and CORS by extension, were not very intuitively designed abstractions/APIs to begin with.
How do they determine whether a PR is AI-assisted and therefore requires senior review? A junior engineer could still copy-paste AI-generated code and claim it as their own.