We shipped the feature we are named for. It was off by default.
96% of developers don't fully trust AI-generated code. Only 48% of them verify it before it ships ( Sonar, 2026 ). That gap is the reason our product exists: you review every AI change as a diff before it touches your project. Last week I found our review gate was off by default. The feature worked. Nobody met it. The mechanism was never the problem. The agent is intercepted at the tool boundary,…
The feature the product is named for has been released, but it was off by default. According to a survey, 96% of developers don't fully trust code generated by AI. Only 48% of them check the code before shipping. That's the reason for this product's existence: it allows users to review every AI change as a diff before it touches their project.
However, the review gate was off by default, and nobody noticed it. The mechanism worked as intended, intercepting the agent at the tool boundary and providing a unified diff, waiting for approval without timeout. There was also an "Approve the rest" button to avoid rubber-stamping. Despite all these features, a new user experienced the same write-without-asking behavior as with other AI tools, which defeats the purpose of the gate.
The issue was discovered by running a real build and observing the agent creating a file without asking for approval. Two problems were identified: the approved diff might not be the one that got written, and the gate ran on the original tool arguments where pre-write hooks (which can modify file content) were applied after the user's response.
This led to a situation where a user approved one change while a different one got written. The order of operations was: safety hooks → hook modifications → user review of the final arguments → write. One retry ended the entire run. When a user rejects a change, models may propose it again. However, the code capping the number of repeats to 2 could lead to a full run abort if the first repeat satisfied the condition.
This fix involved changing a single boolean value. However, tests were insufficient as they only checked the third request stopped the run, but not the second one. The article emphasizes that a feature flag defaulting to off is indistinguishable from never having built the feature. Tests passing and the changelog indicating successful shipping do not guarantee the feature's existence or functionality.
The article concludes that a review gate silently defaulting to off is an example of this failure mode.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
