The agent handed me a function that fetched a Stripe customer, read customer.tax_ids.data[0].value, and used it as the VAT number for an invoice. Clean code. Typed. Named well. It read perfectly. It also assumed every customer has exactly one tax ID at index zero, that the array is never empty, and that the first entry is the VAT number rather than, say, an Australian ABN. None of those assumptions hold. The function would work in every test I'd bother to write by eye and break the first time a real customer had two tax IDs or none. I almost merged it, because nothing about reading it told me to stop.
That is the entire problem with reviewing AI-generated code, and it's why I keep a separate checklist for it. When I decided where to delegate to an agent in the first place, I closed with a line: how to review what the agent produces is a whole discipline of its own. This is that discipline. The companion to it is the prompts that prevent bad output before generation — that's the upstream half. This is the downstream half: what to look for once the code already exists, when prevention didn't catch everything, because it never does.
Why AI Code Fails in a Different Place
Human code and AI code fail in different places, and that difference is the whole reason a generic review is the wrong tool.
