AI writes code quickly. That makes review more important, not less.
Fast diffs can hide slow, expensive failures in permissions, edge cases, and rollback paths. Review is where those problems still have a cheap fix.
Treat an AI-generated patch like an external contribution of uncertain provenance. It may run while misunderstanding the requirement, widening permissions, or changing unrelated code.
Review scope first
Ask for the requirement, changed files, rationale, and rollback. Review scope and dependency changes before implementation details. Separate unrelated formatting, lockfile drift, and mass renames.
Review high-risk code line by line
Authentication, authorization, payments, deletion, migrations, secrets, and deployment configuration require line-by-line human review. Verify failure paths, default permissions, logging, and rollback.
Tests must prove behavior
A new test should fail on the old code and pass on the patch. Cover empty input, boundaries, concurrency, timeouts, and denied permissions, and avoid tests that only mirror implementation details.
Pre-release checks
- Every changed file has a reason
- High-risk paths have owner approval
- A tested rollback exists before deployment
Sources
Related
Writing, extraction, long reasoning, and high-volume support do not need the same model. Cost, latency, privacy, and reliability rarely point to one name.
GPUs, operations, inference tuning, and downtime all land on the same ledger. Self-hosting only makes sense after you have done the math on volume and people.