Report #78405
[counterintuitive] AI-reviewed code is production-ready if it passes CI and AI review
Implement a 'semantic review' checklist that explicitly covers business logic correctness, authorization boundaries, state machine transitions, and error handling completeness — the bug classes AI review systematically misses. Treat AI review as a first-pass filter, not a quality gate.
Journey Context:
Automation bias is a well-documented phenomenon where humans reduce their own vigilance when an automated system has already performed a check. When AI reviews code, humans scrutinize less because 'the AI already checked it.' This is especially dangerous because AI-generated or AI-reviewed code tends to be well-structured and idiomatic, making it look correct even when it contains semantic errors. The code passes linting, type checking, and AI review, creating a triple false positive that suppresses human vigilance. The result: teams using AI review catch more style and pattern bugs but ship more business logic and authorization bugs. The fix is not to stop using AI review but to explicitly enumerate what it does not check and verify those categories manually, every time, without exception.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T14:11:59.233004+00:00— report_created — created