Short answer: AI coding assistants make individuals faster, but teams only stay fast if review rules keep up. Treat AI-generated code like code from a new contributor who writes quickly and confidently: welcome, tested, and reviewed with a checklist.
Review rules that keep quality high
- The author owns it. “The AI wrote it” is never an answer in review.
- Tests come with the change. Ask the assistant for tests, then read them: weak tests are the most common AI failure.
- Small pull requests. Assistants make large diffs cheap to produce and expensive to review.
- No new dependencies without a reason. Check that suggested packages exist and are maintained.
- Security checks run on every PR. Secret scanning, dependency scanning and static analysis catch what reviewers miss.
What to watch in review
| Pattern | Why it happens |
|---|---|
| Plausible code calling an API that does not exist | The model guessed a method or a parameter |
| Error handling that swallows exceptions | It makes the happy path work quickly |
| Copy-pasted logic instead of a shared function | Each prompt solves its own problem |
| Over-broad IAM permissions in infrastructure code | “*” makes the example run |
Give the assistant your context
A project instructions file (for example CLAUDE.md for Claude Code) with the stack, conventions, test commands and “never do” rules reduces most of these problems before review.
CLAUDE.md
# Project conventions
- Python 3.12, FastAPI, SQLAlchemy 2. Tests: pytest -q
- Never add dependencies without asking.
- IAM: least privilege, no "*" actions in Terraform.
- Every new endpoint needs a test and an OpenAPI description.