Code Review in the AI Era

Code review remains central, but the question changes. Traditional review asks, "Why did the author write it this way?" AI-era review asks, "Does this code behave as intended in our system?"

Broken Assumptions

Four Traits of AI-Generated Code

1. It is often syntactically clean.
2. It has limited understanding of hidden system contracts.
3. It can be too generic or overfit to the prompt.
4. It presents wrong code with the same confidence as right code.

Review Priority

Common AI Mistakes

Silent Failure

if (!order) {
  console.log('Order not found')
  return { success: true }
}

The code is clean but operationally dangerous. A missing order should be logged, alerted, retried, or rejected depending on the webhook contract.

N+1 Queries

AI often writes correct per-record logic and misses loop-level performance:

const membersWithProjects = await Promise.all(
  team.members.map(async (member) => {
    const projects = await db.project.findMany({ where: { assigneeId: member.id } })
    return { ...member, projects }
  })
)

Reviewers should look for query count, unbounded collections, and missing null handling.

Security Gaps

const users = await db.user.findMany({
  where: { email: { contains: query } },
})
return NextResponse.json(users)

Ask: Is the route authenticated? Are fields selected explicitly? Is the search allowed by policy? Is input length constrained?

AI Collaboration PR Template

### Intent
- What behavior changed?

### AI involvement
- Draft generation / tests / refactor / research

### Human verification
- Business rule checked
- Security and permissions checked
- Tests passed

### Reviewer focus
- Missing edge cases
- Over-generalized abstraction
- Hidden system contracts

Next

Read Testing Strategy Shift to turn review criteria into executable safeguards.