When I mention that an agent merged a change to production with no human in the loop, the reply is often: "that's not possible/dangerous/risky." Usually followed by the (quite likely accurate) scenarios where it'll fail.
Engineers tend to think in binaries and cater for the worst case: either every PR merges itself or none does, and the one they picture is the migration that drops a table, not the patch bump. As a general statement it's hard to argue with, because nobody is proposing the general case. So break that habit first, with a smaller question: is one possible? Think of it as wallpaper. You don't take the whole wall at once, you find a corner that lifts.
My first one was a minor patch bump. An agent raised it, CI went green, and it merged without anyone reading it.
I let it through because the unit tests covered the change and I trusted them. Deploys were cheap, rollback was easy, and the observability was good enough that if it broke I would know (probably) before a customer did. Those three things -- more than the agent -- were what made the first one safe.
It was anticlimactic. Nothing happened, which is the point. What had changed was that I was no longer the thing standing between a green build and production.
Then it snowballed: chores went next, the patching and housekeeping that nobody wanted to review anyway[1]. Documentation and support fixes followed, then anything pure frontend with a limited blast radius. Now an evaluator categorizes each PR as it arrives and decides which ones go straight through[2]. It looks at what the PR touches and how far a mistake would travel, then sorts it by how many eyes it needs. That happens at two points: when the PR first lands, if it is ready as pushed ("merge when green"), and again after a round of AI review and fixes, if it is good to go now.
Some still go to a human, and I expect they always will. Architectural changes, anything touching security, and interface changes all wait for me. The evaluator's job is to route them, not to be brave.
The track record so far is nothing bad. We have rolled back a couple of times for visual quirks, which is what the limited blast radius was for (we have a higher tolerance for this). On the day I hit 100 merged PRs, 23 of them never had a human touch them[3]. A couple of days later it was 170+ PRs and half were "automerge."
So, back to the question. Nobody has to concede the general case to get started. One minor patch bump, with tests you trust, a deploy you can reverse, and dashboards you watch: almost everyone says yes to that. Even if it's an effort to get those tests in order where you're happy, it's worth it. That's the start of compound interest.
That's the corner. Start tearing there, and once it's up the rest comes away a strip at a time[4].