home
›
cheatsheets
›
ai_assisted_development
›
ai_native_development
Free to read Every card and diagram, and Quiz me
2
Free account Star cards. Your Quiz me marks are kept, so next time you drill just what you missed
3
Pro All 49 answers on this sheet, My sheet across every topic, and PDFs
A free account keeps your stars and Quiz me marks. Pro adds all 49 answers on this sheet, My sheet across every topic, and PDFs.
/
Read
Quiz me
Comfortable
Compact
0
Click any code to copy it
Done 0 /0
To review 0
On this sheet
01 AI-native workflow02 Review AI code03 Review at team scale04 Tests as guardrails05 Debug with a model06 Migrations & refactors07 Docs & agent config08 Policy, vendors & IP09 Metrics & tech debt10 Skills, juniors & hiring
The model AI makes code cheap to write, not cheap to check. Verification is the bottleneck, so an AI-native process is built to reject wrong work early. Whoever submits a change owns every line . "The AI wrote it" never answers a review question. A spec and tests written first give the agent a contract. Without them you get plausible code you can't judge. Set review depth by risk . Ask what a mistake would cost, whether you could undo it and whether anyone would notice. Count outcomes like lead time, rework and escaped defects. Lines, commits and acceptance rate climb on their own once AI writes code. Drafting is cheap, so each step is there to send wrong work BACK early. Machines check what they can, and a person judges the rest.
AI-native workflow how a team hands work to AI and stays in control AI-native, not vibe coding Say what makes a team AI-native Specs and tests guide its agents. Risk gates limit them.
Judge whether AI adoption is working Delivery quality, effort and defects, not tool adoption.
Define vibe coding Accepting AI code unread. Karpathy coined it in 2025.
Say when vibe coding is fine Throwaway prototypes, never code a team maintains.
Tip Adding AI tools to an unchanged process isn't AI-native.
Trap In an AI interview round, accepting unread code fails you.
Replace prompt-and-pray Name the prompt-and-pray anti-pattern Send a vague request, accept a big result, hope it works.
Start a task the healthy way Goal, criteria, context and non-goals. Plan big work first.
Size each step Small batches. Read each diff and check it before the next.
Tip When a result is wrong, fix the spec or context, then rerun.
Trap Don't let an agent run risky commands without your approval.
Write the spec first Define spec-first development Agree behavior and acceptance criteria before any code.
Say why spec-first matters more with AI Agents turn a vague request into a big wrong diff fast.
Tip A spec has examples, tests, non-goals and failure cases.
Trap A spec needn't be long. It only settles what changes the result.
Stop over-engineering Keep generated code simple Set non-goals and a diff budget. Justify each new dependency.
Check a result for over-engineering Compare with a direct version. Delete unused flexibility.
Tip Broad prompts reward complete-looking, overbuilt code.
Review AI code catch what fluent code hides Review AI code at least as hard Say why AI code needs a full review Fluent code hides wrong assumptions and insecure patterns.
Read an AI-written diff Read all of it, and compare what it does with the requirement.
Know where to look hardest Edge cases, failures, auth, secrets and external calls.
Review the tests it wrote Check them separately. They can repeat the code's mistake.
Trap AI can widen a change. Look for edits outside the task.
Catch a hallucinated API Define a hallucinated API An invented method or option with a real-sounding name.
Catch one before it ships The compiler flags it. In dynamic code, run a quick test.
Check a package before you install it npm view <package> Look at its registry entry, publisher and source.
Tip Check unfamiliar calls in the docs for your version.
Trap Models invent package names. Attackers register them.
Spot plausible-but-wrong code Define plausible-but-wrong code Code that compiles and looks right but breaks a subtle rule.
Give a classic example An endpoint checks login but never who owns the record.
Say why experienced reviewers miss it Familiar structure lulls them, and big diffs cause fatigue.
Build a taxonomy of AI-typical defects Group defects by cause, with a detection and a prevention.
Tip Start from the requirement and try to prove the code wrong.
Trap Clean style doesn't show the author knew the domain rules.
Match the codebase's idioms Check AI code fits your codebase Compare it with the nearest maintained example.
Get code that fits from the start Show the model one approved example. Reuse existing code.
Tip Each one-off pattern is one more thing readers must learn.
Trap A formatter can't enforce architecture or domain rules.
Review AI code for security Catch authentication without authorization Write abuse and privilege tests.
Catch injection or sensitive data in logs Use taint analysis and redaction checks.
Catch agents with broad permissions Least privilege, plus human approval for risky actions.
Catch unsafe retries or exposed secrets Threat-model the change and test its failure paths.
Tip Review what a change exposes, not whether AI wrote it.
Trap In one study, AI users wrote less secure code, yet more often believed it secure.
Set trust per change Ask what a mistake would cost Security, money or irreversible steps need the most care.
Ask whether a failure would show Delayed or hidden failures need more review than obvious ones.
Ask whether it can be checked exactly Exact, independent checks earn trust. Subjective ones don't.
Tip Familiar patterns, small diffs and narrow permissions help.
Trap Don't give the model a fixed trust score. Rate each change.
Review at team scale keep review ahead of what agents produce When PR volume doubles Set the pace after agents double PR volume Review capacity sets it, not how much agents can generate.
Set what every PR must carry A small diff, acceptance criteria, test evidence and risks.
Take mechanical checks off reviewers Automate format, type, dependency, secret and security checks.
Tip Track queue time, rework and escaped defects.
Trap Send back AI work its author can't explain.
Gate changes by risk tier Gate a low-risk change, like docs Automated checks and owner review.
Gate a medium-risk change, like domain logic Focused integration tests and domain review.
Gate a high-risk change, like auth or payments Security or architecture approval, then a staged rollout.
Keep the gates honest Audit a sample of merges. Tune gates by rework and incidents.
Tip Every tier blocks secrets, surprise packages and weakened tests.
Trap Tier by what a change could break, not by who wrote it.
Beat the verification bottleneck Cut what humans must check Codemods, strong types, property tests and static analysis.
Rebuild the lifecycle around checking Acceptance tests first, sandboxed agents, staged rollouts.
Tip Cap work in progress at your real review capacity.
Trap Asking reviewers to skim faster only hides the bottleneck.
Refuse AI slop PRs Define an AI slop pull request Work the author generated but never understood or checked.
Say why maintainers find it harmful It shifts the checking onto them, and polish hides defects.
Tip Signs are vague claims, unrelated edits and weak tests.
Trap If the author can't explain it, it isn't ready for review.
Disclose AI help Decide whether to disclose AI help Follow repo policy. Volunteer it when it helps reviewers.
Write the disclosure note The tool, what it drafted, your checks and any doubts.
Credit the tool the Linux kernel way git commit --trailer "Assisted-by: <tool>" The kernel also bars AI agents from adding Signed-off-by.
Tip In a study of 281 open-source AI policies, most allowed AI help and nearly half required disclosure.
Trap Disclosure never moves ownership. You still own every line.
Tests as guardrails tests the agent has to pass, not rewrite Guide an agent with TDD Start the loop Review one test and confirm it fails for the right reason.
Ask for the code The smallest implementation that makes that test pass.
Stop the agent weakening the test Block test edits you haven't approved.
Grow the contract Add edge cases and failure paths, then rerun the checks.
Tip The agent runs the test itself, so feedback comes fast.
Trap A green suite proves only the cases it tests.
Audit AI-written tests Name the biggest risk in AI-written tests Code and tests share one wrong reading of the requirement.
Spot weak AI tests Tautologies, heavy mocking, snapshots, no edge cases.
Make them worth trusting Take expected results from a spec. Read every assertion.
Trap High coverage can still miss realistic faults.
The test oracle problem model tests code same source Both come from one model, so the tests share its misreading and pass.spec model tests code independent The tests come from a reviewed spec, so a misread in the code fails them.Define the test oracle problem Deciding what the correct expected result is.
Get expected results the model didn't invent A reviewed spec, an expert, an old version or a math rule.
Tip Metamorphic tests check relations. Adding a search filter never adds results.
Trap More tests can't fix an assumption they all share.
Test with properties Define property-based testing Check a rule on many generated inputs, not a few examples.
Name useful properties Serialize then parse returns the value. Sorting keeps every item.
Tip The tool shrinks each failure to a small counterexample.
Trap More inputs can't fix a wrong invariant.
Find tests that assert nothing Define mutation testing It plants small bugs and checks that some test fails.
Read a surviving mutant A planted bug no test caught. Add a test if it matters.
Run mutation tests in JavaScript or Python npx stryker run mutmut run
Tip AI suites often hit high coverage with weak assertions.
Trap Some mutants behave like the original. Don't target the score.
Debug with a model evidence picks the cause, not a fluent story Debug by hypothesis Say what a talking rubber duck adds It challenges assumptions, proposes causes and experiments.
Open a debugging chat Observed and expected behavior, and one testable hypothesis.
Pick the next experiment The smallest safe one that tells the leading causes apart.
Fix the bug once evidence backs a cause Write a test that reproduces it first, then fix it.
Tip Keep facts, guesses and results apart in the chat.
Trap A fluent story can anchor you. Only evidence decides.
Read logs and stack traces with AI Give it the right evidence Exact error, key frames, timing, environment, recent change.
Clean logs before you paste them Remove credentials, personal data and customer payloads.
Ask for a reading you can check Observations with cited lines, then ranked causes to test.
Tip Feed back each exact result, so each round narrows the cause.
Trap A whole log dump invites a diagnosis with no evidence.
Migrations & refactors change thousands of files and prove it Codemod or agent Rename a deprecated function everywhere A codemod. Review its one rule and a sample of results.
Migrate tests whose setup differs per file An agent. Review each decision it makes.
Combine the two An agent drafts a codemod. Test it on a sample, then run it.
Preview a jscodeshift codemod without writing files npx jscodeshift -t transform.js src --dry --print
Tip Use the most deterministic tool that can do the job.
Trap Agent output varies run to run. Review its edits separately.
Migrate in verified batches Set the migration pattern Define the target. Migrate one area by hand and review it.
Check each batch git grep -n "oldFunction(" Run tests, types and static rules. Search for old usage left.
Finish safely Integration tests, realistic data and a tested rollback plan.
Tip Use feature flags or dual reads for risky batches.
Trap Track progress from the repo, not the agent's claims.
Make a huge refactor reviewable Split a huge AI refactor diff Keep renames and formatting apart from behavior changes.
Organize its commits One transformation per commit, plus a map of the files.
Tip Guard contracts with tests, and stay green at every stage.
Trap Too big to understand? Shrink the scope and regenerate.
Docs & agent config docs that people and agents can trust Generate docs with AI Check an AI summary or release note It can invent behavior. Check each claim against the code.
Check AI-written examples They can hold outdated syntax. Run them in CI.
Tip Generate API docs from schemas, and give pages owners.
Trap Fluent AI text looks finished even when it's wrong.
Keep docs fresh Stop docs drifting from the code Update them in the same pull request as the code or config.
Catch broken docs automatically Run their commands, links and code samples in CI.
Find the pages a change affects Let AI flag them, and have a person confirm.
Tip Give key guides a review date. Delete ownerless pages.
Trap Stale docs now mislead coding agents as well as people.
Write docs agents can use Say what docs for AI must hold Boundaries, public contracts and why odd choices were made.
Give agents the commands The exact setup, build, test and operational commands.
Help retrieval tools find things Stable terms, clear headings, maybe an llms.txt index.
Tip Generate the model-facing copy from the human docs.
Trap Never keep a key rule only in an image or meeting notes.
Treat prompts and agent config as code Decide when a prompt is an engineering artifact Once it shapes production work, permissions or releases.
Manage one like code Version it, review it and test each change against evals.
Trap Keep secrets out, and temporary notes apart from rules.
Policy, vendors & IP the rules a company writes and enforces Write an AI usage policy Cover the tools Approved vendors and their retention and training terms.
Cover the data Which data may go in a prompt, and rules for credentials.
Cover agents and people Agent permissions and sandboxing. Human ownership and review.
Roll AI out across 500 engineers By repo risk tier. Pilot against a baseline, then expand.
Tip Enforce it with managed settings, scanning and CI.
Trap Pause adoption when generation outgrows safe review.
Manage licensing and IP risk Name the IP risk in AI code AI code can resemble licensed source, with no known origin.
Turn on public-code matching It blocks matches with public code, or cites the source.
Honor a customer contract's limits Turn it into repo rules, like Copilot content exclusion.
Tip Scan licenses in CI, and take disputes to counsel.
Trap A vendor's assurances don't replace your own review.
Choose an AI coding tool Evaluate an AI coding tool Real tasks in your repos. Compare quality, rework and cost.
Check its governance Data retention and training use, identity and audit logs.
Tip Re-evaluate often. Models, prices and controls change.
Trap Demos and benchmarks tell you little about your repos.
Keep key decisions human Name the architecture calls humans must own Contracts, trust boundaries, data models, one-way migrations.
Make that boundary real Named owners, decision records and checks that encode them.
Tip Models can research options but can't take accountability.
Trap Revisit decisions on new evidence, not when AI slips in a pattern.
Metrics & tech debt measure outcomes AI can't inflate Why velocity metrics break Say why velocity metrics mislead with AI They count activity, and AI makes activity cheap.
Say where the effort went Writing got faster, but review and rework grew unseen.
Quote METR's 2025 trial Experienced developers were 19% slower with AI, yet felt 20% faster.
Tip A good metric can't rise just because AI wrote more code.
Metrics that resist gaming State Goodhart's law A measure stops working once it becomes a target.
Pair each metric with a counter-metric Lead time with review delay, defects with rework and reverts.
Name the metrics that stay meaningful Outcomes. Delivery, quality, reliability, maintainability.
Never set targets for these Lines, prompts, commits, acceptance rate and PR count.
Tip Publish how you use telemetry. Never rank individuals.
Trap A change after AI adoption doesn't prove AI caused it.
Control AI tech debt Curb duplication Track it, and make assistants look for existing helpers first.
Spot churn Watch for early rewrites, reverts and deletions of new code.
Keep people able to run the code Find code few people understand, and rotate people onto it.
Tip Clean up measured hotspots, and count deletion as progress.
Trap Never turn AI attribution into a performance score.
Skills, juniors & hiring keep people able to work without the tool Avoid skill atrophy Keep your own reasoning sharp Form your own hypothesis before you ask the model.
Stay able to explain AI code Read every AI diff, and explain its key behavior unaided.
Decide which skills to develop deeply Problem framing, architecture, security, debugging and ops.
Decide what to delegate Boilerplate and mechanical work, where checks are strong.
Tip Practice fundamentals by hand, and explain decisions to others.
Trap Losing the assistant should slow the team, not stop it.
Grow junior engineers Give juniors work they learn from Bounded features they trace, test, debug and run themselves.
Check a junior's understanding Ask them to explain decisions and rework them after review.
Tip Teach them to challenge the model. Mentors teach judgment.
Learn a codebase with AI Get a first map of a new codebase Ask for components and one request path, then verify it.
Turn the map into real knowledge Trace a request, make a small change, debug a failure yourself.
Trap Aim to reason about it alone, not to recall an AI summary.
Talk about your AI workflow Know what interviewers probe Judgment. What you delegate and how you catch mistakes.
Structure your answer One real example, with a mistake you caught and what changed.
Trap Bragging about how much code AI wrote misses the point.
Hire when AI can pass the screen Redesign a coding screen for AI Allow AI, and plant a flawed suggestion to review.
Get real signal from a candidate Ask about trade-offs and evidence. Pair with a fixed rubric.
Tip Test unaided fundamentals openly, in a separate exercise.
Trap Take-home work no longer proves who did the reasoning.
Nothing matches. Try a shorter word, or clear the search.
Practice Guided practice One question at a time, with the ones you miss coming back. Practice 49 interview questions Full answers, from beginner to expert.
Found this useful? Pass it on.
Share on LinkedIn
Share on X
Copy link
This sheet stays free. With Pro , you can:
Every answer on this sheet. Read the full answer to all 49 questions it links, not just the 7 free ones.My sheet. The cards you star and the ones you miss in Quiz me, from every sheet, on one page to quiz and print.PDFs. Download this sheet and My sheet, laid out for A4, with every question a link to its answer.The rest of Pro. Every answer in the question library, and 1,000 AI credits a month.
