In September I ran a hands-on workshop at AI Summit Barcelona. The room had 50 seats and 186 people saved the session. In October I gave a talk at TechLead Conf London, and a few days later I showed the same material to founders and CTOs from the Adara Ventures portfolio.
Three very different rooms. All of them got stuck on the same question: the agent wrote the code, so who checked it? -> The most honest answer I got was "I don't have time."
At TechLead, the most-voted question after Matt Pocock's main-stage talk was how to stop review overwhelm and burnout. At our booth, an engineer put it more bluntly: "If it breaks in prod, I'm responsible, and so is my boss."
I've worked in software since the mid-1990s (yeah, a veteran). For most of that time, writing code was the expensive part. Now an agent writes in minutes what used to take a day, and reading it still takes as long as it always did.
So I now ask teams one question: who does the checking? The answers fall into five rough levels.
0. You read it. You prompt, read the output and paste it in. It works until the volume doubles.
1. You brief the agent better. A CLAUDE.md or AGENTS.md, your conventions, your architecture notes. The output improves. The agent can still ignore the file, and the file goes stale. In the Barcelona workshop we added an AGENTS.md before adding any check, on purpose, so people could see what context fixes and what it leaves alone. My slide said: context is necessary. It is not sufficient.
2. Something outside the agent checks. The agent calls a check, through an MCP server for example, and fixes what comes back. That loop was the core of the workshop. The weak spot is that the agent decides whether to call it, and an agent reviewing its own work tends to agree with itself.
3. The agent can't skip the check. A hook runs it on every edit. A check on every pull request catches code that never went near your agent: a contractor, another team, an agent nobody told you about. A scan of the whole repository catches what was there before. One thing I got wrong while preparing the talk: hooks run on the machine that runs the agent. A hook in my local setup governs me, not my team. To govern the team it has to live in the repository or in org policy.
4. The same checks everywhere, with a record. Every repository, every team, every agent. Rules catch the known bad patterns, like a hard-coded secret. AI review asks what a rule can't: is this in the right layer, does the table have the index it needs, what happens under load? And there's a record of what was checked, found and fixed. That record is what the engineer at our booth needs, and what their boss will ask for. It matters even more for the apps business teams now build with AI tools, which end up holding real data.
I closed the TechLead talk with one line: humans don't leave the loop, they move up it. At level 0 you read every line. At level 4 you set the rules and read the record.
If you want to place your team, try this. If an agent's change broke production tomorrow, what would have stopped it, and what could you show afterwards? If the answer to both is "someone who was busy", you're at level 0.
I'm Chief of Strategy & Board Member at Quality Clouds. Disclosure - We build Norma, which runs these checks at levels 2 to 4, and it has a permanent free plan.
Top comments (0)