Adding a GraphQL layer to a Django REST API is solid work for a code agent.

This is a well-trodden software pattern — wrapping REST with GraphQL using Graphene-Django or Strawberry follows a repeatable structure. The same scaffolding steps apply each time: define types, wire resolvers to REST calls, add complexity middleware.

Core success criteria are crisp (schema works, fields are selectable, complexity limits fire), but decisions like which fields to expose, how to model nested relationships, and what complexity thresholds to set require input from the team. Without that context, the agent will make reasonable but potentially wrong defaults.

The agent needs the existing Django codebase, REST endpoint definitions, serializer schemas, and ideally sample API responses to infer types accurately. If these are provided, execution is straightforward; if the agent must guess at the data model, errors compound quickly.

Mistakes are largely reversible — bad code can be reviewed and corrected before deployment. However, a misconfigured complexity limit could either block legitimate queries or fail to prevent abuse, and a schema that leaks unintended fields could be a security issue if deployed without review.

Schema design decisions — which fields to expose, how to handle pagination, what complexity scoring weights make sense for this app's usage patterns — benefit from product and engineering context the agent doesn't have. A human review pass before deployment is genuinely necessary, not just cautious.