You know the workflow. You describe the task, the AI writes the PowerShell, it looks right, you run it. Most days this works fine.
Then September happened. A story went around about an rmdir suggested by AI landing in the wrong place, and a drive disappearing. Generation is a solved problem now. Verification is the part most of us skip.
Here is the pass I run before any script written by AI touches a production box. It takes about five minutes.
First, read every destructive cmdlet. Search the script for Remove, Stop, Set, Clear, Disable, and Format. For each hit, ask one question: if this runs against the wrong scope, what breaks? AI is confident about syntax and careless about scope. A Remove ADUser with a bad filter is a resume event.
Second, run it with WhatIf. It is free information. But know its limits. Not every cmdlet honors WhatIf, and it will not catch logic errors. It catches the obvious disasters, which are the ones that end careers.
Third, limit the blast radius before the real run. Run against one test object, one OU, one mailbox. Confirm the output, then widen. If the script has no natural scope limit, that is the review finding. Add one.
Two honest caveats. This pass catches accidents, not malice. If you do not trust the source of the script, no checklist saves you. And WhatIf lies by omission. It shows what would happen, not what the script meant to do. Read the logic, not just the preview.
The free tool from my last post fits here too. Same idea, other direction. Sanitize logs before they go into the AI, verify scripts before they come out of it. It is free here: https://mightyleo.gumroad.com/l/ojbhki
Full disclosure, it is also one of ten tools in a bigger bundle I sell for $19. Thirty environment aware prompts, ten PowerShell tools, ten checklists: https://mightyleo.gumroad.com/l/ai-playbook-for-it-engineers. The sanitizer stays free regardless. If your verify pass catches something good, tell me in the comments. I collect war stories.
Top comments (0)