By Kevin Lant
A large share of the first draft of the software we build is written with AI assistance. None of it is unreviewed. This post sets out what that second sentence means in practice, because “human review” is the kind of phrase that can mean anything.
Who reviews
Every project has a named engineer. That person reads every change before it merges, and their name is on the review record. They are not a rotating pool, and they are the person you meet at the increment demo.
What they check
Four things, in order:
- Does it do what the increment said it would do. The scoped plan lists what each increment ships. A change that does something else is sent back, however good it is.
- Is it safe to run. Inputs are validated, secrets are not in the source, and anything that touches your data has a test that proves what it does with it.
- Can the team who inherits it change it. Your team owns this code after handover, so a change only its author can read is rewritten before it merges.
- Does it still deploy from a clean checkout. The pipeline runs on every change, and a change that needs a hand-run step to work is not finished.
What the record looks like
Each merged change carries the reviewer’s name, the increment it belongs to and the tests that ran. You can read that record from the first commit, because the repository is yours from the first commit.
What this costs
Review is not a line on the invoice. It is priced into the increment rather than added on. We would rather you see it in the number than find out later that it was skipped.