Developing Software with AI: Why Understanding Code Still Matters

Artificial intelligence can aid software development by generating initial code, suggesting tests, explaining unfamiliar code, and assisting with debugging. However, creating code rapidly and delivering a reliable product are distinct goals. It is crucial to retain the ability to understand what the AI produces while utilizing these tools.

AI's value hinges on asking the right questions. For instance, deleting a document from an application involves determining who can delete it (owner, administrator, or any authenticated user), whether deletion is permanent, and how to handle concurrent edits. AI assists in identifying these questions, but the answers must align with the product's actual requirements.

Software development expertise involves translating requests into verifiable rules, selecting appropriate classes, components, and libraries. A solution may appear correct in isolation yet be unsuitable for the application it belongs to. It could duplicate existing functionality, introduce unnecessary dependencies, or mix user interface logic, data access, and business rules.

Therefore, guiding AI requires contextual understanding: the repository's structure, conventions, software versions, and the responsibilities of its components. Asking AI to "follow best practices" is insufficient; we must comprehend which choices genuinely serve the project. A successful demonstration provides limited insight into the application's overall behavior.

Generated code may appear valid yet contain errors or security vulnerabilities. GitHub warns that even if an AI's explanation seems convincing, it is essential to review and test the code. Compilation remains vital for catching certain issues, but correctness against requirements and security necessitates additional checks. In a .NET example, hiding a button that deletes a document does not guarantee protection against unauthorized deletion.

The interface must enforce authorization in the server-side operation or API. Verification should include six cases: an authenticated owner, another user, an anonymous user, an unauthenticated identity with the same claim, an identity without an identifier, and a different identifier. Tests should also be reviewed to ensure they reflect the actual requirements.

AI can aid in writing tests, but both the implementation and tests must be rooted in the correct interpretation of the requirements. This involves identifying edge cases, comparing expected results with documentation, product rules, and observed behavior. Performance optimization requires measuring response times, memory usage, database queries, and behavior under realistic workloads.

However, shorter or more sophisticated code does not automatically imply better performance. Measuring productivity gains, such as time saved on writing, fixing, integrating, and reviewing, and the code's long-term maintainability is crucial. Developers should avoid promises of faster development applicable to every project.