2 min lesson
The auditor's three questions
Recall the main items in "The auditor's three questions", then connect each one to the work.
Step 1 of 2
- Who approved this?
- What did the checks say?
- Does the description match the diff?
AI changes who drafts the code. It must not change how code lands. The pipeline that protects production stays exactly the same whether a human or an agent typed the characters: scoped PR, deterministic checks, independent review, code-owner approval.
Your job as a field engineer is to make AI productive inside that pipeline. Never weaken the pipeline to make AI look productive.
Every author, human or agent-driven, inherits one mandate: the PR must be well-scoped, well-tested and well-described so that nothing downstream changes. Downstream means your reviewers, your CI, your CODEOWNERS routing, your release process, your auditors. Force any of those to behave differently with bigger diffs, weaker checks or skipped approvals and you've leaked the cost of AI velocity onto the parts of the system that exist to contain risk.
- Well-scoped
- One coherent change a reviewer can hold the whole blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition. of in their head. Refactor and behavior change never ride in one PR.
- Well-tested
- Tests assert the intended behavior, run in CI and would fail if the change regressed. Coverage is an input to the gate, not the trophy.
- Well-described
- Title and body state intent, approach and risk. The description must match the diff. Drift between them is itself a review finding.
- Accountable
- A required human code-owner approves. That signature is the non-collapsible step. AI is a signal feeding it, never a substitute for it.
"AI changes who writes the first draft. It does not change how code earns its way into production. The PR is still the unit of trust and a human code-owner still signs."