CORE GUIDE
AI code review
Reviewing AI-generated code means independently checking behavior, scope, security and maintainability against repository evidence rather than accepting a plausible diff or the agent's own explanation.
Mental model
AI code review is an evidence-backed merge decision. Generation and review must be separable roles: the authoring model may explain its intent, but acceptance comes from tests, diffs, contracts, static checks and human judgment.
Why it matters
AI can generate a large change faster than a reviewer can build context, which shifts the bottleneck from typing to verification. Without a disciplined review model, teams either rubber-stamp plausible changes or over-review every line. A risk-based process focuses attention on changed behavior, boundaries and evidence.
01
Review from contracts outward
Start with the task spec and acceptance criteria, inspect the diff for scope expansion, then run targeted tests and the relevant regression suite. Trace changes across API, data, auth and side-effect boundaries. Separate style feedback from correctness blockers, and require additional evidence for migrations, security-sensitive paths or behavior that is difficult to test automatically.
02
Example: a clean refactor silently widens permissions
An agent simplifies a service layer and all unit tests pass, but the new helper is called with a broader credential than before. A line-by-line style review may miss the consequence. Boundary-aware review follows the permission flow, flags the widened capability and blocks the merge until the least-privilege contract is restored.
Common failure modes
- Reviewing the agent's explanation instead of the actual diff and runtime evidence.
- Treating passing targeted tests as proof that unrelated regressions are impossible.
- Spending equal review effort on formatting and consequential boundary changes.
Engineering heuristics
- Review changed behavior and boundaries before style.
- Require evidence independent of the generating model.
- Escalate review depth with migration, permission, money and irreversible side effects.
Takeaways
- 01AI changes the speed of generation, not the need for independent review.
- 02Merge decisions should be anchored in repository evidence.
- 03Risk-based review is more effective than uniformly reading every generated line.
Reading evidence
This records actions you actually took; it does not claim mastery, proficiency, or certification.
Used in
This Concept is reused across these canonical learning paths.
Related concepts from the Knowledge Graph
These relationships come from the canonical graph, not a separate Guide taxonomy.