AI-generated code should enter the same review process as code written by a contributor, with extra attention to invented APIs, hidden assumptions and changes outside the requested scope.
Search for embedded credentials, temporary debugging output, disabled validation and broad exception handling. Generated code often tries to make a test pass by weakening the surrounding system.
Check every referenced library method against the installed version. Review database changes for rollback behavior and external calls for retries, idempotency and rate limits.
Use a staging environment and maintain a rollback path. AI can accelerate implementation, but responsibility for the running system remains with the team that approves it.
Inspect the change boundary
Read the complete diff before running anything. Confirm that only expected files changed and that dependencies, lockfiles, permissions or deployment settings were not modified without explanation.Search for embedded credentials, temporary debugging output, disabled validation and broad exception handling. Generated code often tries to make a test pass by weakening the surrounding system.
Verify behavior
Run formatting, static analysis, unit tests and relevant integration tests. Add cases for empty input, invalid permissions, timeouts and partial failures. A successful happy path does not establish production safety.Check every referenced library method against the installed version. Review database changes for rollback behavior and external calls for retries, idempotency and rate limits.
Require human ownership
The person merging the change should be able to explain its control flow, security assumptions and failure modes. If nobody understands a generated section, simplify or rewrite it before deployment.Use a staging environment and maintain a rollback path. AI can accelerate implementation, but responsibility for the running system remains with the team that approves it.