AI Can Write the Code. Your Real Job Is Becoming the Reviewer — Here’s How to Do It Properly

AI-generated code is becoming increasingly common, but developers must still act as reviewers to ensure the code is correct, secure, maintainable, and worth merging. Here's a review workflow to follow:

1. Begin with the requirement, not the diff. Ask questions about security, expiration dates, and user session handling before diving into the code.

2. Examine the architecture, not just the syntax. Ensure business logic is in the right layer and check whether the agent duplicated existing services or ignored your project structure.

3. Test the happy path and unexpected cases. Try breaking the implementation by simulating API timeouts, duplicate requests, record conflicts, and more.

4. Don't rely solely on AI-generated tests. Encourage AI to find five ways the implementation could fail and review or add critical tests yourself.

5. Be cautious of new dependencies. Check if they are necessary, actively maintained, secure, and don't bring in unnecessary transitive dependencies or incompatible licenses.

6. Pay attention to permissions beyond just the code. Ensure the agent has appropriate access to filesystems, terminals, Git repositories, environment variables, databases, and cloud services.

7. Review both added and removed code in the diff. Developers often focus on added lines but forget to examine what was taken away. Consider why code was deleted and if it caused any regressions.

8. Leverage automation to verify AI-generated changes. Run tools like type checkers, linters, and automated testing suites to catch potential issues that may have been missed during manual review.