DEV Community

Cover image for AI Can Write the Code. Your Real Job Is Becoming the Reviewer — Here’s How to Do It Properly
Robert Adamson
Robert Adamson

Posted on

AI Can Write the Code. Your Real Job Is Becoming the Reviewer — Here’s How to Do It Properly

#ai #productivity #webdev #programming

AI can write code now.

That part is no longer surprising.

You can describe a feature to Copilot, Claude Code, Cursor, Codex, or another coding agent and get a working implementation in minutes.

Sometimes it is genuinely impressive.

But there is a bigger question:

Can you actually trust the code enough to ship it?

According to the Stack Overflow 2025 Developer Survey, 84% of developers use or plan to use AI tools.

At the same time, trust in AI-generated output is still limited. One of the biggest frustrations developers report is getting an answer that is almost right, but not quite.

Source:
https://survey.stackoverflow.co/2025/ai

And that “almost right” part is exactly where developers still matter.

AI may write more code.

But humans still need to decide whether that code is correct, secure, maintainable, and actually worth merging.

So here is a simple review workflow I think every developer should practice.

1. Start With the Requirement, Not the Diff

Imagine you tell an AI agent:

Add password reset support.
Enter fullscreen mode Exit fullscreen mode

A few minutes later, it generates the full feature.

The code may compile.

The UI may work.

The tests may even pass.

But before reading the implementation, ask:

  • How long should reset tokens remain valid?
  • Can the same token be used twice?
  • What happens if the email does not exist?
  • Should existing sessions be logged out?
  • Are we exposing whether a user account exists?

This matters because AI can build the wrong thing very cleanly.

So before asking:

Does this code work?

Ask:

Does this solve the correct problem?

That one question can save a lot of time.

2. Check the Architecture Before the Syntax

AI is usually good at writing a function.

It is not always good at understanding where that function belongs inside your system.

For example, an agent might create something like:

components/
├── PaymentForm.tsx
├── PaymentAPI.ts
├── StripeService.ts
└── Database.ts
Enter fullscreen mode Exit fullscreen mode

Everything may technically work.

But should database access really live beside your UI components?

Probably not.

Before focusing on small syntax details, check:

  • Is the business logic in the right layer?
  • Did the agent duplicate an existing service?
  • Did it ignore your existing project structure?
  • Did it bypass abstractions already used elsewhere?
  • Will another developer understand this code six months from now?

A file can contain perfectly valid code and still be in the wrong place.

3. Try to Break the Happy Path

AI-generated features often work very well when everything goes as expected.

Production does not always behave that way.

Take a simple example:

const user = await getUser(id);

return user.name;
Enter fullscreen mode Exit fullscreen mode

Looks fine.

Until:

user === null
Enter fullscreen mode Exit fullscreen mode

Now start asking harder questions.

What happens if:

  • the API times out?
  • the request is submitted twice?
  • two users update the same record?
  • the database is unavailable?
  • the token already expired?
  • the user is not authorized?
  • the input is empty or extremely large?
  • an external service returns malformed data?

These cases are not exciting.

They are also where a lot of real bugs live.

A good review is not just checking whether the normal flow works.

It is trying to find where the normal flow stops working.

4. Don’t Let AI Be the Only One Testing AI

A common AI workflow now looks like this:

AI writes the feature
        ↓
AI writes the tests
        ↓
Tests pass
        ↓
Merge
Enter fullscreen mode Exit fullscreen mode

That looks efficient.

But there is a weakness.

If the model misunderstood the requirement, it may also write tests based on the same misunderstanding.

So instead of only asking:

Write tests for this feature.
Enter fullscreen mode Exit fullscreen mode

Ask harder questions.

For example:

Find five ways this implementation could fail.
Enter fullscreen mode Exit fullscreen mode 
What important edge cases are missing?
Enter fullscreen mode Exit fullscreen mode 
Which inputs could break this function?
Enter fullscreen mode Exit fullscreen mode 
What security assumptions does this implementation make?
Enter fullscreen mode Exit fullscreen mode

Then review or add the most important tests yourself.

AI should absolutely help with testing.

It just should not be the only judge of its own work.

5. Pay Attention to New Dependencies

This is easy to miss.

An AI agent may install a package because it makes the task faster.

For example:

npm install some-package
Enter fullscreen mode Exit fullscreen mode

Before accepting it, check:

  • Do we really need this dependency?
  • Is it actively maintained?
  • Does it have known security issues?
  • How many transitive dependencies does it bring in?
  • Could the same thing be done with a few lines of existing code?
  • Does the license fit the project?

Sometimes the AI-generated feature is small.

The dependency it adds is not.

Do not review only what AI wrote.

Review what AI introduced.

6. Review Permissions, Not Just Code

This matters even more with coding agents.

A modern coding agent may have access to:

Filesystem
Terminal
Git repository
Environment variables
Database
Cloud services
External APIs
Enter fullscreen mode Exit fullscreen mode

That is what makes agents powerful.

It is also what makes mistakes more expensive.

The Stack Overflow 2025 survey reported that many developers are concerned about the security and privacy risks of AI agents.

Source:
https://survey.stackoverflow.co/2025/ai

Whenever an agent makes a large change, pay extra attention to:

.env files
authentication
authorization
API permissions
database migrations
CI/CD configuration
cloud credentials
secrets
Enter fullscreen mode Exit fullscreen mode

The question is no longer only:

What code did AI write?

It is also:

What was AI allowed to touch?

That difference matters.

7. Look at What AI Deleted

Developers naturally focus on the green lines in a Git diff.

But AI can also remove important code.

Sometimes too much code.

So when reviewing a large AI-generated change, look carefully at the red lines too.

Ask:

  • Why was this removed?
  • What depended on it?
  • Was this behavior intentionally replaced?
  • Did AI remove validation?
  • Did it remove an edge-case handler?
  • Could this cause a regression somewhere else?

A new feature can work perfectly while silently breaking an old one.

Always review both sides of the diff:

+ Added code
- Removed code
Enter fullscreen mode Exit fullscreen mode

8. Use Automation to Verify Automation

Human review does not mean manually checking everything.

Your existing developer tools become even more important when AI is writing more code.

Run things like:

Type checking
Linting
Unit tests
Integration tests
Security scanning
Dependency scanning
Static analysis
Build verification
CI
Enter fullscreen mode Exit fullscreen mode

For example:

npm run lint
npm run typecheck
npm test
npm run build
Enter fullscreen mode Exit fullscreen mode

AI increases how quickly we can generate code.

So our verification process also needs to become stronger.

9. Use the Junior Developer Test

Before you merge an AI-generated PR, ask yourself one simple question:

If a junior developer submitted this exact PR, would I approve it?

If the answer is no, do not merge it just because AI wrote it quickly.

If you would ask a human developer:

Why did you choose this architecture?

Ask the AI.

If you would request more tests from a human:

Request more tests from the AI.

If you would reject insecure code from a human:

Reject insecure AI code too.

The author changed.

The quality bar should not.

The Developer Role Is Moving Up a Level

AI is already making developers faster.

Stack Overflow’s 2025 survey reported that developers using AI agents often see real productivity gains.

Source:
https://survey.stackoverflow.co/2025/

GitHub has also reported rapid growth in AI-assisted software development and repositories using LLM-related tools.

Source:
https://github.blog/news-insights/octoverse/octoverse-a-new-developer-joins-github-every-second-as-ai-leads-typescript-to-1/

So AI will probably keep doing more of this:

Boilerplate
CRUD code
Components
Refactoring
Tests
Documentation
Small features
Enter fullscreen mode Exit fullscreen mode

But developers still need to handle:

Requirements
Architecture
Security
Trade-offs
Verification
Debugging
System design
Product decisions
Enter fullscreen mode Exit fullscreen mode

That is the interesting shift.

The best developer may no longer be the person who can type code the fastest.

It may be the person who can look at AI-generated code and quickly answer:

Is this actually correct, safe, maintainable, and ready for production?

That is a much more valuable skill than simply knowing how to prompt an AI coding tool.

Final Thought

AI can write code.

That is becoming normal.

The harder part is knowing whether the code deserves to ship.

So the next time an AI agent changes 20 files in three minutes, do not be impressed only by the speed.

Open the diff.

Check the architecture.

Break the happy path.

Review the permissions.

Run the tests.

Then decide whether the code is actually good enough.

AI can be the author.

You still need to be the reviewer.

What has changed most in your own workflow since you started using AI coding tools?

Do you still review every AI-generated file before merging?

Top comments (0)