How to Review
AI-Generated Code

Example 1: Accepted - Generated Tests With Human Verification

Prompt, written in the test file:

# Prompt: Write pytest tests for task_service.create_task
# that cover: valid input, duplicate title, missing required field.

Output, after the developer reviewed and edited it:

def test_create_task_success(mock_db):
    # AI-generated - reviewed by alice on 2026-05-16
    service = TaskService(mock_db)
    task = service.create_task(
        title="Write tests",
        description="Cover edge cases",
        owner_id=1
    )
    assert task.title == "Write tests"
    assert task.status == "todo"
    mock_db.add.assert_called_once()
    mock_db.commit.assert_called_once()

def test_create_task_duplicate_title(mock_db):
    # AI-generated - reviewed by alice on 2026-05-16
    # EDIT: added explicit assertion for error message
    service = TaskService(mock_db)
    mock_db.query.return_value.filter.return_value.first.return_value = Task(id=1)

    with pytest.raises(ValueError) as exc_info:
        service.create_task(title="Duplicate", description="x", owner_id=1)

    assert "already exists" in str(exc_info.value)  # <- human added this line

The AI produced the structure and three cases. The developer checked that the assertions test behaviour rather than merely confirming the function runs, and added the missing assertion on the error message. The EDIT note is the part worth copying: it tells the next reviewer exactly where the human intervened, which is the difference between a codebase you can audit and one you can only hope about.

Example 2: Rejected - Generated Business Logic in an AMBER File

Prompt, in app/handlers/tasks.py:

# Prompt: Add a PATCH endpoint to update task status

Output, rejected in review:

@router.patch("/tasks/{task_id}/status")
def update_task_status(task_id: int, status: str, db: Session = Depends(get_db)):
    # AI-generated - reviewed by bob on 2026-05-17
    task = db.query(Task).filter(Task.id == task_id).first()
    if not task:
        raise HTTPException(status_code=404, detail="Not found")
    task.status = status
    db.commit()
    return task

It compiles, it is readable, and it is wrong in three ways.

The status parameter accepts any string, so the status enum contract is unenforced and a fresh task can jump straight to archived. There is no ownership check, so any authenticated user can modify any task by changing the identifier in the URL - the pattern OWASP catalogues under broken access control, including the case of viewing or editing someone else's record by supplying its identifier.² And nothing is logged or emitted, so downstream reporting silently loses the transition.

The reviewer rewrote it by hand: a service-layer call, an enum-validated request schema, and an ownership check. The route decorator and response shape were fine as generated. The conditional logic and the security surface were not, which is precisely the line the AMBER tier is meant to draw.

Example 3: Never Generated - A RED File

No AI tool goes near this one.

# HUMAN-ONLY - see AI_GOVERNANCE.md
# app/config.py

from pydantic_settings import BaseSettings

class Settings(BaseSettings):
    database_url: str
    jwt_secret: str
    jwt_algorithm: str = "HS256"
    jwt_expiry_hours: int = 24

    class Config:
        env_file = ".env"

settings = Settings()

If a tool suggests changing the JWT algorithm or supplying a default secret, the suggestion is ignored without discussion. The header comment exists so that nobody has to remember the rule, and so a new joiner learns it the first time they open the file.