AI-generated code deserves at least normal scrutiny because fluent syntax can hide false assumptions, invented interfaces, and insecure patterns. It can also widen the change beyond what was asked.
Read the complete diff and compare its behavior with the requirement.
Verify unfamiliar APIs and dependencies against authoritative sources for the version you use.
Test boundary cases and failures. Then check authorization, the handling of secrets and other data, and every external call.
Review generated tests independently, because they may repeat the implementation's mistake.
The submitter owns every line. Set review depth from the change's impact and reversibility, not from how quickly or confidently the code appeared.
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
If an AI wrote the code that caused an outage, who is accountable?The submitter and the approving reviewer. 'The tool wrote it' is no defense, so don't merge code you can't explain.
AI code needs at least the same review as human code, because fluent, confident-looking code can still rest on false assumptions, made-up APIs or insecure patterns.
I start by reading the whole diff against the requirement, since generated changes often reach beyond what was asked.
Any API or dependency I don't know, I check against the official docs for the version we actually run, and I test the boundary cases and failure paths.
Then I look hard at authorization, how secrets and other data are handled, and every external call.
I review the generated tests on their own, because a test written by the same model can repeat the implementation's mistake and still pass.
Whoever submits it owns every line, so I set review depth by the change's impact and how hard it is to undo, not by how fast or confident the code looked.
Weak answers to avoid
Treats passing tests as proofIf the same model wrote the tests, they can encode the same wrong assumption. Say you check the tests against the requirement on their own.
Blanket distrust with no methodSaying AI code is just worse is not a review process. Name the failure modes and set depth by the change's impact and reversibility.
Stays vague: 'just review it carefully'That shows no process. Walk the concrete checks: the full diff against the requirement, unfamiliar APIs against docs, edge cases, auth and secrets.
Blames the tool for bugs'The AI wrote that part' signals weak ownership. The submitter owns every line, so don't submit code you can't explain or defend.
Interview lens
Likely follow-ups, what you can say, and the weak answers to avoid.
