Ship safely

AI-Generated Code Review Checklist

Review AI-written code by behavior and risk, including dependencies, auth, data, tests, accessibility, performance, and rollback.

Short answer

Review the diff before the summary, then verify behavior according to risk. Focus first on auth, data access, secrets, dependencies, migrations, and public interfaces. Require tests or another observable proof for every important claim.

Who this is for

Developers reviewing agent output and builders deciding whether an AI-built change is ready to merge or deploy.

What is changing now

As agents take larger tasks, review is shifting from code style to evidence: what changed, which commands ran, what failed, how the result was tested, and whether it can be reversed.

Problems this guide solves

Generated code looks coherent, so hidden requirements are not checked.
Large diffs mix feature work, cleanup, dependencies, and formatting.
Reviewers rerun the happy path but miss permissions and failure behavior.

Step 1

Triage the diff by risk

Review the areas with the highest consequence before spending time on style.

List changed behavior, dependencies, migrations, configuration, and public interfaces.
Flag auth, permissions, payments, secrets, destructive data changes, and remote commands.
Separate unrelated formatting or cleanup from the functional change.
Reject a diff that is too broad to explain and test confidently.

Step 2

Verify behavior and failure

A passing happy path is necessary but not sufficient.

Run targeted tests and inspect whether they would fail without the change.
Test invalid input, wrong permissions, empty data, timeouts, and provider failure.
Check logs and error messages for secrets or unnecessary personal data.
Inspect accessibility and performance when the user interface changed.

Step 3

Prepare the merge and recovery

The reviewer should know what will happen after approval.

Confirm migrations are reversible or backed up.
Verify new environment variables and deployment configuration.
Write a short test plan for preview or staging.
Record the rollback trigger and the last known working version.

Final checklist

The diff matches one explained task.
Dependencies, migrations, and configuration are reviewed.
Auth, ownership, data access, and secrets are tested where relevant.
Tests prove the important behavior and failure cases.
UI changes pass keyboard, mobile, and basic performance checks.
Deployment requirements and rollback are known.

Common questions

Should AI code get stricter review than human code?

Use stricter review when the change is broad, unfamiliar, or high risk. The standard should follow consequence and evidence, but generated code often increases speed and diff size enough to justify more deliberate checks.

What should every AI code review include?

At minimum, inspect the diff, run relevant tests, check dependency and configuration changes, verify important permissions, and know how to roll back.

Can the same agent review its own code?

It can find issues, but that is not independent evidence. Use automated checks and a human reviewer, or a separately scoped review process, for important changes.

Use this on one real task

Apply the checklist before changing tools again. A useful setup should make the result easier to prove, review, and recover.