AI coding agents are getting good enough that the bottleneck is often not generation anymore. The bottleneck is deciding what can safely be delegated, what evidence counts as done, and when a human should step back in.
Here is the small preflight checklist I use before letting an agent touch a non-trivial codebase.
1. Write the task as a contract, not a vibe
A weak task says: "improve the checkout flow".
A safer task says:
- change only the checkout summary component and its tests
- preserve the existing payment provider integration
- do not modify database schema or environment variables
- success means the current checkout tests pass and one new regression test covers the empty-cart state
The agent needs boundaries more than enthusiasm.
2. Separate exploration from editing
I like to run agent work in two passes:
- read-only reconnaissance: map files, risks, dependencies, and likely test commands
- implementation: make the smallest change that satisfies the contract
This prevents the common failure mode where the agent starts editing before it understands the code path.
3. Require a verification plan before code changes
Before accepting edits, ask for:
- commands it expects to run
- tests it expects to add or update
- what it will not verify and why
- rollback points if the change touches multiple files
If the verification plan is vague, the implementation will usually be vague too.
4. Put hard stops around sensitive areas
For most projects, I do not let agents change these without explicit approval:
- auth/session logic
- billing and subscriptions
- migrations or production data scripts
- security headers and permission checks
- analytics events used for decisions
- deployment configuration
The goal is not to distrust AI. It is to keep high-blast-radius changes under human control.
5. Review for behavior, not just diff size
Small diffs can still change behavior. I check:
- did it alter an API contract?
- did it remove an edge-case branch?
- did it make a test weaker to pass?
- did it introduce hidden cost, latency, or privacy impact?
The best agent workflows treat tests, screenshots, logs, and rollback notes as part of the deliverable, not as afterthoughts.
A simple rule of thumb
Delegate implementation when the task has clear boundaries and cheap verification. Keep planning, architecture, security, billing, and product tradeoffs human-led.
AI agents are most useful when they are treated like fast junior teammates with excellent recall: give them context, define done, inspect the evidence, and keep the dangerous switches out of reach until you are ready.
Top comments (0)